API Platform Core does not call GraphQl securityAfterResolver

Summary A security check that gets called after GraphQl resolvers is always replaced by another one as there's no break in this clause: https://github.com/api-platform/core/pull/6444/filesdiff-09e3c2cfe12a2ce65bd6c983c7ca6bfcf783f852b8d0554bb938e8ebf5e5fa65R56...

CVE-2025-23204

The CVE affects api-platform/core. Starting in version 3.3.8, a logic flaw in the GraphQL security flow is caused by an omitted break in the AccessCheckerProvider switch that is supposed to run after GraphQL resolvers; this fallback can bypass security checks if there is only a post-resolver secu...

CVE-2025-23204 GraphQl securityAfterResolver not called

API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Starting in version 3.3.8, a security check that gets called after GraphQl resolvers is always replaced by another one as there's no break in a clause. As this falls back to security, the impact is there only when...

RLSA-2024:11232 Moderate: unbound:1.16.2 security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbounded name compression could lead to Denial of Service CVE-2024-8508 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other...

RLSA-2025:1681 Important: bind security update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

RLSA-2024:9423 Moderate: python-dns security update

The python-dns package contains the dnslib module that implements a DNS client and additional modules that define certain symbolic constants used by DNS, such as dnstype, dnsclass and dnsopcode. Security Fixes: dnspython: denial of service in stub resolver CVE-2023-29483 For more details about th...

@_lan/uni-libs (0.0.3), @aosweb/osui (>=0.0.23, <=0.0.25) +311 more potentially affected by CVE-2025-27597 via @intlify/message-resolver (>=9.1.0, <=9.1.10)

@intlify/message-resolver NPM version =9.1.0, =0.0.23, =1.0.0, =0.1.87, =0.3.0, =0.0.0, =0.12.0, =1.6.0, =1.1.0, =0.0.1, =3.0.0-3060520221121001, =3.0.0-4020320240708001, =3.0.0-alpha-5030220261016001 and more Source cves: CVE-2025-27597 Source advisory: OSV:GHSA-P2PH-7G93-HW3M...

@_lan/uni-libs (0.0.3), @aosweb/osui (>=0.0.23, <=0.0.25) +311 more potentially affected by CVE-2025-27597 via @intlify/message-resolver (>=9.1.0, <=9.1.10)

@intlify/message-resolver NPM version =9.1.0, =0.0.23, =1.0.0, =0.1.87, =0.3.0, =0.0.0, =0.12.0, =1.6.0, =1.1.0, =0.0.1, =3.0.0-3060520221121001, =3.0.0-4020320240708001, =3.0.0-alpha-5030220261016001 and more Source cves: CVE-2025-27597 Source advisory: GHSA-P2PH-7G93-HW3M...

GHSA-P2PH-7G93-HW3M Vue I18n Allows Prototype Pollution in `handleFlatJson`

Vulnerability type: Prototype Pollution Vulnerability Locations: js v9.1 nodemodules/@intlify/message-resolver/index.js v9.2 or later nodemodules/@intlify/vue-i18n-core/index.js Description: The latest version of @intlify/message-resolver 9.1 and @intlify/vue-i18n-core 9.2 or later, previous...

@_lan/uni-libs (0.0.3), @aosweb/osui (>=0.0.23, <=0.0.25) +311 more potentially affected by CVE-2025-27597 via @intlify/message-resolver (>=9.1.0, <=9.1.10)

@intlify/message-resolver NPM version =9.1.0, =0.0.23, =1.0.0, =0.1.87, =0.3.0, =0.0.0, =0.12.0, =1.6.0, =1.1.0, =0.0.1, =3.0.0-3060520221121001, =3.0.0-4020320240708001, =3.0.0-alpha-5030220261016001 and more Source cves: CVE-2025-27597 Source advisory: MEND:CVE-2025-27597...

CVE-2025-27597: Improperly Controlled Modification of Object Prototype Attributes

Vue I18n is the internationalization plugin for Vue.js. @intlify/message-resolver and @intlify/vue-i18n-core are vulnerable to Prototype Pollution through the entry function: handleFlatJson. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the...

PT-2025-10096

Name of the Vulnerable Software and Affected Versions @intlify/message-resolver version 9.1 @intlify/vue-i18n-core versions 9.2 and later Description The vulnerability is a Prototype Pollution issue through the entry function: handleFlatJson. An attacker can supply a payload with Object.prototype...

Linux Distros Unpatched Vulnerability : CVE-2022-40188

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Knot Resolver before 5.5.3 allows remote attackers to cause a denial of service CPU consumption because of algorithmic complexity. During an attack, an...

Linux Distros Unpatched Vulnerability : CVE-2023-26249

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Knot Resolver before 5.6.0 enables attackers to consume its resources, launching amplification attacks and potentially causing a denial of service. Specifically...

Linux Distros Unpatched Vulnerability : CVE-2023-31147

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom are unavailable, c-ares uses rand to generate random numbers used for DNS query id...

Linux Distros Unpatched Vulnerability : CVE-2023-27585

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.13 and prior affects applications...

CLSA-2025-1741126041 bind: Fix of CVE-2024-11187

CVE-2024-11187: fix excessive resource usage by limiting additional section processing and adjusting resolver tests...

Linux Distros Unpatched Vulnerability : CVE-2021-23017

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory...

Linux Distros Unpatched Vulnerability : CVE-2020-14312

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it...

OESA-2025-1215 bind security update

BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name System protocols. BIND includes a DNS server named, which resolves host names to IP addresses; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server ...