How many CVEs does apollo have?

apollo has 8 published CVE records since 2024, including 6 in the last two years.

How many apollo CVEs are in CISA KEV?

None of apollo's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which apollo products have the most CVEs?

The apollo products with the most published CVEs are @apollo/gateway, @apollo/query-planner, @apollo/explorer, @apollo/federation-internals, @apollo/sandbox.

What are the most common weakness types in apollo CVEs?

apollo's CVEs most often map to these CWE weakness types: CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-1333 (Inefficient Regular Expression Complexity), CWE-288 (Authentication Bypass Using an Alternate Path or Channel), CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')).

Are there public exploits for apollo vulnerabilities?

No apollo CVEs currently have a tracked public exploit in this dataset.

How many critical apollo vulnerabilities are there?

apollo has 1 critical and 7 high-severity CVEs.

What is the average severity of apollo CVEs?

The average CVSS base score across apollo's scored CVEs is 8.1.

RadicalNotion.AI

Log in Start free

8 CVEs

apollo Vulnerabilities

Name: apollo vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for apollo.

8

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

0

Public exploits

PoC or exploit code

8.1

Avg CVSS

2024–2026

Overview

apollo has 8 published CVE records since 2024, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 0 have a known public exploit. The average CVSS base score across scored CVEs is 8.1.

This page aggregates every publicly disclosed vulnerability (CVE) affecting apollo products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on apollo's vulnerability posture, as a share of its 8 published CVEs.

Average CVSS: 8.1
Critical / high: 100%
Actively exploited (KEV): 0%
Public exploit available: 0%
Patch available: 100%

Severity and exploitation

How the CVSS severity of apollo's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical1

High7

Medium0

Low0

In CISA’s Known Exploited Vulnerabilities catalog

0

None of apollo's CVEs are currently listed in CISA's KEV catalog.

Public exploits

0

No apollo CVEs currently have a tracked public exploit.

Most affected products

The apollo products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in apollo CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish apollo CVE records.

GitHub_M8 CVEs

Disclosure activity by year

How many apollo CVEs were published each year.

2024

2

2025

4

2026

2

Latest apollo CVEs

The most recently disclosed vulnerabilities affecting apollo.

Apollo Federation has prototype pollution via incomplete key sanitization
CWE-1321
Critical · CVSS 9.9
EPSS 0.5%2026-03-13
Apollo Server is vulnerable to denial of service with `startStandaloneServer`
CWE-1333
High · CVSS 7.5
EPSS 0.6%2026-02-04
@apollo/composition has Improper Enforcement of Access Control on Interface Types and Fields
CWE-288
High · CVSS 7.5
EPSS 0.4%2025-11-13
Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass
CWE-352
High · CVSS 8.2
EPSS 0.1%2025-09-26
Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass
CWE-770
High · CVSS 7.5
EPSS 0.6%2025-04-07
Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion
CWE-770
High · CVSS 7.5
EPSS 0.5%2025-04-07
High vulnerability · 2024-08-27
CWE-674
High · CVSS 8.7
EPSS 1.0%2024-08-27
XSS in @apollo/experimental-nextjs-app-support
CWE-80
High · CVSS 8.2
EPSS 0.4%2024-01-30

Track new apollo CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor apollo CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

microsoft36,228 CVEs linux22,545 CVEs Google16,149 CVEs Apple15,070 CVEs Oracle12,706 CVEs Debian10,225 CVEs IBM8,823 CVEs Red Hat8,079 CVEs

Browse all vendors

Frequently asked questions

Common questions about apollo vulnerabilities.

How many CVEs does apollo have?: apollo has 8 published CVE records since 2024, including 6 in the last two years.
How many apollo CVEs are in CISA KEV?: None of apollo's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which apollo products have the most CVEs?: The apollo products with the most published CVEs are @apollo/gateway, @apollo/query-planner, @apollo/explorer, @apollo/federation-internals, @apollo/sandbox.
What are the most common weakness types in apollo CVEs?: apollo's CVEs most often map to these CWE weakness types: CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-1333 (Inefficient Regular Expression Complexity), CWE-288 (Authentication Bypass Using an Alternate Path or Channel), CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')).
Are there public exploits for apollo vulnerabilities?: No apollo CVEs currently have a tracked public exploit in this dataset.
How many critical apollo vulnerabilities are there?: apollo has 1 critical and 7 high-severity CVEs.
What is the average severity of apollo CVEs?: The average CVSS base score across apollo's scored CVEs is 8.1.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track apollo vulnerabilities

Monitor new apollo vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing