Skip to contentSensiolabs Symfony vulnerabilities
- sensiolabs symfonySymfony: The "private_ranges" Trusted Proxies Shortcut Trusts Clients Presenting an IPv4-Mapped, 6to4, Teredo or NAT64 Address as Reverse ProxiesCVE-2026-1216196.3 Medium
- sensiolabs symfonySymfony: XXE (Local File Read) in Config XmlUtils::parse() via validateOnParse = trueCVE-2026-123824Fix available2.3 Low
- sensiolabs symfonySymfony: ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested ObjectsCVE-2026-122053Fix available6.9 Medium
- sensiolabs symfonySymfony: DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files, Letting a Client Read Any Server FileCVE-2026-121623Fix available8.2 High
- sensiolabs symfonySymfony: Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document Hold a ProcessCVE-2026-123792Fix available8.7 High
- sensiolabs symfonySymfony: Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main RequestCVE-2026-123339Fix available2.3 Low
- sensiolabs symfonySymfony: Programmatic Logins Skip the checkPostAuth() Method of User CheckersCVE-2026-123746Fix available2.3 Low
- sensiolabs symfonySymfony: HtmlSanitizer Does Not URL-Sanitize srcset and imagesrcset: Media Scheme and Host Allow-List BypassCVE-2026-121949Fix available2.3 Low
- sensiolabs symfonySymfony: Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses allowing SSRF Filter BypassCVE-2026-123125Fix available6.3 Medium
- sensiolabs symfonySymfony: NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports (Incomplete Fix for CVE-2024-50342)CVE-2026-123119Fix available2.3 Low
- sensiolabs symfonySymfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority (Incomplete Fix for CVE-2026-45066)CVE-2026-118517Fix available2.3 Low
- sensiolabs symfonySymfony: The Serializer Builds UploadedFile Objects From Request Data, Letting a Client Point an Upload at Any Server FileCVE-2026-118515Fix available8.4 High
- sensiolabs symfonySymfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path ReferencesCVE-2026-121971Fix available8.2 High
- sensiolabs symfonySymfony: HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar (Incomplete Fix for CVE-2026-48761)CVE-2026-121373Fix available5.3 Medium
- sensiolabs symfonySymfony: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access ControlCVE-2026-118516Fix available6.3 Medium
- sensiolabs symfonySymfony: X.509 Authentication Impersonation via DN Value Injection (incomplete fix for CVE-2026-45063)CVE-2026-118513Fix available7.7 High
- sensiolabs symfonySymfony: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the ProcessCVE-2026-109449Fix available8.7 High
- sensiolabs symfonySymfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the ProcessCVE-2026-109413Fix available8.7 High
- sensiolabs symfonySymfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request HeaderCVE-2026-108082Fix available8.7 High
- sensiolabs symfony, cloud foundry routing +1 moreSymfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 NormalizationCVE-2026-48784Fix available5.1 Medium
- sensiolabs symfony, symfony html-sanitizer +1 moreSymfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing DefenseCVE-2026-48760Fix available5.3 Medium
- sensiolabs symfony, symfony mailomat-mailer +1 moreSymfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm DowngradeCVE-2026-48747Fix available6.3 Medium
- sensiolabs symfony, actions http-client, symfony http-foundation +2 moreSymfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClientCVE-2026-48736Fix available6.9 Medium
- sensiolabs symfony, symfony security-http +1 moreSymfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET RoutesCVE-2026-48489Fix available8.7 High
- sensiolabs symfony, symfony html-sanitizer +1 moreSymfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> contentCVE-2026-48761Fix available5.3 Medium
- jetbrains runtime, sensiolabs symfony +1 moreSymfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv MismatchCVE-2026-47767Fix available8.3 High
- sensiolabs symfony, symfony twilio-notifier +1 moreSymfony: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event InjectionCVE-2026-47212Fix available6.9 Medium
- sensiolabs symfony, symfony json-path +1 moreSymfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoSCVE-2026-45756Fix available8.2 High
- sensiolabs symfony, /mailtrap-mailer mailtrap-mailer +1 moreSymfony: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event InjectionCVE-2026-45755Fix available6.9 Medium
- sensiolabs symfony, symfony lox24-notifier, mailjet-mailer +2 moreSymfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event InjectionCVE-2026-45754Fix available6.9 Medium
- sensiolabs symfony, symfony html-sanitizer +1 moreSymfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS)CVE-2026-45753Fix available2.1 Low
- eemeli yaml, sensiolabs symfony +1 moreSymfony: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() RegexCVE-2026-45305Fix available8.7 High
- eemeli yaml, sensiolabs symfony +1 moreSymfony: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")CVE-2026-45304Fix available8.7 High
- sensiolabs symfonySymfony: [Yaml] Harden the parser when handling untrusted inputCVE-2026-45133Fix available8.2 High
- sensiolabs symfony, symfony monolog-bridge +1 moreSymfony: Unauthenticated PHP Object Deserialization in MonologBridge server:log ListenerCVE-2026-45077Fix available8.3 High
- sensiolabs symfony, symfony http-kernel, security-http +2 moreSymfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]CVE-2026-45075Fix available8.3 High
- sensiolabs symfony, symfony security-http +1 moreSymfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket ReplayCVE-2026-45074Fix available7.6 High
- cache symfonySymfony: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefixCVE-2026-45073Fix available6.3 Medium
- sensiolabs symfony, symfony twig-bridge, web-profiler-bundle +2 moreSymfony: Stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File RenderingCVE-2026-45072Fix available2.0 Low
- sensiolabs symfony, symfony dom-crawler +1 moreSymfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = trueCVE-2026-45071Public exploitFix available8.7 High
- go standard library mime, sensiolabs symfony +1 moreSymfony: Email Header Injection via Non-Token Characters in Mime Parameter NamesCVE-2026-45070Fix available6.3 Medium
- sensiolabs symfony, symfony security-http +1 moreSymfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp ClaimsCVE-2026-45069Fix available8.8 High
- sensiolabs symfony, symfony mailer +1 moreSymfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient AddressCVE-2026-45068Fix available8.7 High
- sensiolabs symfony, symfony html-sanitizer +1 moreSymfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> MisclassificationCVE-2026-45066Fix available2.3 Low
- sensiolabs symfony, symfony html-sanitizer +1 moreSymfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href SpoofingCVE-2026-45064Fix available2.3 Low
- sensiolabs symfonySymfony: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL InjectionCVE-2026-45065Fix available2.3 Low
- sensiolabs symfonySymfony: Identity Spoofing via Unanchored DN Regex in X509AuthenticatorCVE-2026-45063Fix available9.1 Critical
- sensiolabs symfonySymfony has incorrect argument escaping under MSYS2/Git Bash on Windows that can lead to destructive file operationsCVE-2026-24739Fix available6.3 Medium
- sensiolabs httpfoundation, symfony +1 moreSymfony's incorrect parsing of PATH_INFO can lead to limited authorization bypassCVE-2025-64500Fix available7.3 High
- sensiolabs symfonyCommand execution hijack on Windows with Process class in symfony/processCVE-2024-51736Fix available0.0 None
- Show olderLoading…