symfony

Products

Exploited and recent CVEs

• CVE-2026-49215 Low 2.1 Symfony UX: CSRF Protection Bypass in symfony/ux-live-component — Accept Header is CORS-Safelisted 0.2%
• CVE-2026-49216 Medium 5.1 Symfony UX: XSS in symfony/ux-autocomplete via unescaped AJAX response data 0.3%
• CVE-2026-49211 Medium 6.9 Symfony UX: Information exposure via unescaped LIKE wildcards in EntitySearchUtil 0.5%
• CVE-2026-49208 Medium 6.9 Symfony UX: Format-less date LiveProps parsed with the permissive DateTime constructor 0.4%
• CVE-2026-49210 Low 2.3 Symfony UX: XSS in symfony/ux-live-component via attacker-controlled child component tag 0.3%
• CVE-2026-49212 Medium 6.9 Symfony UX: LiveComponentHydrator HMAC checksum lacks component and slot binding 0.2%
• CVE-2026-49209 Medium 5.3 Symfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requests 0.6%
• CVE-2026-46644 Medium 6.9 symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence 0.5%
• CVE-2026-46644 Medium 6.9 symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence 0.5%
• CVE-2026-48761 Medium 5.3 Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> content 0.3%
• CVE-2026-48761 Medium 5.3 Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> content 0.3%
• CVE-2026-48747 Medium 6.3 Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade 0.2%
• CVE-2026-48747 Medium 6.3 Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade 0.2%
• CVE-2026-48489 High 8.7 Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes 0.6%
• CVE-2026-48489 High 8.7 Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes 0.6%
• CVE-2026-48760 Medium 5.3 Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense 0.3%
• CVE-2026-48760 Medium 5.3 Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense 0.3%
• CVE-2026-48736 Medium 6.9 Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient 0.6%
• CVE-2026-48736 Medium 6.9 Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient 0.6%
• CVE-2026-48736 Medium 6.9 Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient 0.6%
• CVE-2026-48784 Medium 5.1 Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization 0.3%
• CVE-2026-48784 Medium 5.1 Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization 0.3%
• CVE-2026-45068 High 8.7 Symfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address 0.5%
• CVE-2026-45068 High 8.7 Symfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address 0.5%
• CVE-2026-47212 Medium 6.9 Symfony: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event Injection 1.5%
• CVE-2026-47212 Medium 6.9 Symfony: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event Injection 1.5%
• CVE-2026-45071 High 8.7 Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true 0.6%
• CVE-2026-45071 High 8.7 Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true 0.6%
• CVE-2026-45755 Medium 6.9 Symfony: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection 0.3%
• CVE-2026-45754 Medium 6.9 Symfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection 0.4%