Skip to content
Sensiolabs vulnerabilities
Newest
-
sensiolabs symfony
Symfony: XXE (Local File Read) in Config XmlUtils::parse() via validateOnParse = true
CVE-2026-123824
2.3 Low
-
sensiolabs symfony
Symfony: ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested Objects
CVE-2026-122053
Fix available
6.9 Medium
-
sensiolabs symfony
Symfony: DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files, Letting a Client Read Any Server File
CVE-2026-121623
8.2 High
-
sensiolabs symfony
Symfony: Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document Hold a Process
CVE-2026-123792
8.7 High
-
sensiolabs symfony
Symfony: Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main Request
CVE-2026-123339
Fix available
2.3 Low
-
sensiolabs symfony
Symfony: Programmatic Logins Skip the checkPostAuth() Method of User Checkers
CVE-2026-123746
2.3 Low
-
sensiolabs symfony
Symfony: HtmlSanitizer Does Not URL-Sanitize srcset and imagesrcset: Media Scheme and Host Allow-List Bypass
CVE-2026-121949
Fix available
2.3 Low
-
sensiolabs symfony
Symfony: Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses allowing SSRF Filter Bypass
CVE-2026-123125
Fix available
6.3 Medium
-
sensiolabs symfony
Symfony: NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports (Incomplete Fix for CVE-2024-50342)
CVE-2026-123119
Fix available
2.3 Low
-
sensiolabs symfony
Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority (Incomplete Fix for CVE-2026-45066)
CVE-2026-118517
Fix available
2.3 Low
-
sensiolabs symfony
Symfony: The Serializer Builds UploadedFile Objects From Request Data, Letting a Client Point an Upload at Any Server File
CVE-2026-118515
Fix available
8.4 High
-
sensiolabs symfony
Symfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References
CVE-2026-121971
Fix available
8.2 High
-
sensiolabs symfony
Symfony: HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar (Incomplete Fix for CVE-2026-48761)
CVE-2026-121373
Fix available
5.3 Medium
-
sensiolabs symfony
Symfony: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control
CVE-2026-118516
Fix available
6.3 Medium
-
sensiolabs symfony
Symfony: X.509 Authentication Impersonation via DN Value Injection (incomplete fix for CVE-2026-45063)
CVE-2026-118513
Fix available
7.7 High
-
sensiolabs symfony
Symfony: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process
CVE-2026-109449
Fix available
8.7 High
-
sensiolabs symfony
Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process
CVE-2026-109413
Fix available
8.7 High
-
sensiolabs symfony
Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header
CVE-2026-108082
Fix available
8.7 High
-
sensiolabs symfony, cloud foundry routing +1 more
Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization
CVE-2026-48784
Fix available
5.1 Medium
-
sensiolabs symfony, symfony html-sanitizer +1 more
Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense
CVE-2026-48760
Fix available
5.3 Medium
-
sensiolabs symfony, symfony mailomat-mailer +1 more
Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade
CVE-2026-48747
Fix available
6.3 Medium
-
sensiolabs symfony, actions http-client, symfony http-foundation +2 more
Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient
CVE-2026-48736
Fix available
6.9 Medium
-
sensiolabs symfony, symfony security-http +1 more
Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
CVE-2026-48489
Fix available
8.7 High
-
sensiolabs symfony, symfony html-sanitizer +1 more
Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> content
CVE-2026-48761
Fix available
5.3 Medium
-
jetbrains runtime, sensiolabs symfony +1 more
Symfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch
CVE-2026-47767
Fix available
8.3 High
-
sensiolabs symfony, symfony twilio-notifier +1 more
Symfony: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event Injection
CVE-2026-47212
Fix available
6.9 Medium
-
sensiolabs symfony, symfony json-path +1 more
Symfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS
CVE-2026-45756
Fix available
8.2 High
-
sensiolabs symfony, /mailtrap-mailer mailtrap-mailer +1 more
Symfony: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection
CVE-2026-45755
Fix available
6.9 Medium
-
sensiolabs symfony, symfony lox24-notifier, mailjet-mailer +2 more
Symfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection
CVE-2026-45754
Fix available
6.9 Medium
-
sensiolabs symfony, symfony html-sanitizer +1 more
Symfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS)
CVE-2026-45753
Fix available
2.1 Low
-
eemeli yaml, sensiolabs symfony +1 more
Symfony: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex
CVE-2026-45305
Fix available
8.7 High
-
eemeli yaml, sensiolabs symfony +1 more
Symfony: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")
CVE-2026-45304
Fix available
8.7 High
-
sensiolabs symfony
Symfony: [Yaml] Harden the parser when handling untrusted input
CVE-2026-45133
Fix available
8.2 High
-
sensiolabs symfony, symfony monolog-bridge +1 more
Symfony: Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener
CVE-2026-45077
Fix available
8.3 High
-
sensiolabs symfony, symfony http-kernel, security-http +2 more
Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
CVE-2026-45075
Fix available
8.3 High
-
sensiolabs symfony, symfony security-http +1 more
Symfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay
CVE-2026-45074
Fix available
7.6 High
-
cache symfony
Symfony: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix
CVE-2026-45073
Fix available
6.3 Medium
-
sensiolabs symfony, symfony twig-bridge, web-profiler-bundle +2 more
Symfony: Stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering
CVE-2026-45072
Fix available
2.0 Low
-
sensiolabs symfony, symfony dom-crawler +1 more
Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true
CVE-2026-45071
Public exploitFix available
8.7 High
-
go standard library mime, sensiolabs symfony +1 more
Symfony: Email Header Injection via Non-Token Characters in Mime Parameter Names
CVE-2026-45070
Fix available
6.3 Medium
-
sensiolabs symfony, symfony security-http +1 more
Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims
CVE-2026-45069
Fix available
8.8 High
-
sensiolabs symfony, symfony mailer +1 more
Symfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address
CVE-2026-45068
Fix available
8.7 High
-
sensiolabs symfony, symfony html-sanitizer +1 more
Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification
CVE-2026-45066
Fix available
2.3 Low
-
sensiolabs symfony, symfony html-sanitizer +1 more
Symfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing
CVE-2026-45064
Fix available
2.3 Low
-
sensiolabs symfony
Symfony: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection
CVE-2026-45065
Fix available
2.3 Low
-
sensiolabs symfony
Symfony: Identity Spoofing via Unanchored DN Regex in X509Authenticator
CVE-2026-45063
Fix available
9.1 Critical
-
sensiolabs symfony
Symfony has incorrect argument escaping under MSYS2/Git Bash on Windows that can lead to destructive file operations
CVE-2026-24739
Fix available
6.3 Medium
-
sensiolabs httpfoundation, symfony +1 more
Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass
CVE-2025-64500
Fix available
7.3 High
-
sensiolabs symfony
Command execution hijack on Windows with Process class in symfony/process
CVE-2024-51736
Fix available
0.0 None
-
sensiolabs symfony
Open redirect via browser-sanitized URLs in symfony/http-foundation
CVE-2024-50345
Fix available
3.1 Low
- Show olderLoading…