Skip to content
Symfony vulnerabilities
Newest
-
sensiolabs symfony
Symfony: XXE (Local File Read) in Config XmlUtils::parse() via validateOnParse = true
CVE-2026-123824
2.3 Low
-
sensiolabs symfony
Symfony: ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested Objects
CVE-2026-122053
Fix available
6.9 Medium
-
sensiolabs symfony
Symfony: DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files, Letting a Client Read Any Server File
CVE-2026-121623
8.2 High
-
sensiolabs symfony
Symfony: Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document Hold a Process
CVE-2026-123792
8.7 High
-
sensiolabs symfony
Symfony: Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main Request
CVE-2026-123339
Fix available
2.3 Low
-
sensiolabs symfony
Symfony: Programmatic Logins Skip the checkPostAuth() Method of User Checkers
CVE-2026-123746
2.3 Low
-
sensiolabs symfony
Symfony: HtmlSanitizer Does Not URL-Sanitize srcset and imagesrcset: Media Scheme and Host Allow-List Bypass
CVE-2026-121949
Fix available
2.3 Low
-
sensiolabs symfony
Symfony: Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses allowing SSRF Filter Bypass
CVE-2026-123125
Fix available
6.3 Medium
-
sensiolabs symfony
Symfony: NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports (Incomplete Fix for CVE-2024-50342)
CVE-2026-123119
Fix available
2.3 Low
-
sensiolabs symfony
Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority (Incomplete Fix for CVE-2026-45066)
CVE-2026-118517
Fix available
2.3 Low
-
sensiolabs symfony
Symfony: The Serializer Builds UploadedFile Objects From Request Data, Letting a Client Point an Upload at Any Server File
CVE-2026-118515
Fix available
8.4 High
-
symfony
Symfony: HEAD Requests Bypass the methods Option of security.access_control Rules and Firewalls
CVE-2026-118514
6.3 Medium
-
sensiolabs symfony
Symfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References
CVE-2026-121971
Fix available
8.2 High
-
sensiolabs symfony
Symfony: HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar (Incomplete Fix for CVE-2026-48761)
CVE-2026-121373
Fix available
5.3 Medium
-
sensiolabs symfony
Symfony: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control
CVE-2026-118516
Fix available
6.3 Medium
-
sensiolabs symfony
Symfony: X.509 Authentication Impersonation via DN Value Injection (incomplete fix for CVE-2026-45063)
CVE-2026-118513
Fix available
7.7 High
-
sensiolabs symfony
Symfony: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process
CVE-2026-109449
Fix available
8.7 High
-
sensiolabs symfony
Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process
CVE-2026-109413
Fix available
8.7 High
-
sensiolabs symfony
Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header
CVE-2026-108082
Fix available
8.7 High
-
symfony twig
Twig: Sandbox resource exhaustion via unbounded `for` / `range()`
CVE-2026-46627
Fix available
7.1 High
-
auth0 symfony
Auth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK
CVE-2026-50157
Fix available
6.5 Medium
-
symfony twig
Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`
CVE-2026-49981
Fix available
6.0 Medium
-
symfony twig
Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`
CVE-2026-48808
Fix available
6.0 Medium
-
symfony twig
Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters
CVE-2026-48807
Fix available
7.1 High
-
symfony twig
Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys
CVE-2026-48806
Fix available
7.1 High
-
symfony twig
Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`
CVE-2026-48805
Fix available
5.3 Medium
-
symfony ux
Symfony: Path Traversal in symfony/ux-toolkit Allows Arbitrary File Write and Read via Crafted Recipe Manifest
CVE-2026-55878
Fix available
7.8 High
-
symfony ux
Symfony UX: XSS in symfony/ux-icons via unsanitized SVG content in local files and Iconify on-demand responses
CVE-2026-55877
Fix available
6.1 Medium
-
symfony ux
Symfony UX: XSS in symfony/ux-autocomplete via unescaped AJAX response data
CVE-2026-49216
Fix available
5.1 Medium
-
symfony ux
Symfony UX: CSRF Protection Bypass in symfony/ux-live-component — Accept Header is CORS-Safelisted
CVE-2026-49215
Fix available
2.1 Low
-
symfony ux
Symfony UX: LiveComponentHydrator HMAC checksum lacks component and slot binding
CVE-2026-49212
Fix available
6.9 Medium
-
symfony ux
Symfony UX: Information exposure via unescaped LIKE wildcards in EntitySearchUtil
CVE-2026-49211
Fix available
6.9 Medium
-
symfony ux
Symfony UX: XSS in symfony/ux-live-component via attacker-controlled child component tag
CVE-2026-49210
Fix available
2.3 Low
-
symfony ux
Symfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requests
CVE-2026-49209
Fix available
5.3 Medium
-
symfony ux
Symfony UX: Format-less date LiveProps parsed with the permissive DateTime constructor
CVE-2026-49208
Fix available
6.9 Medium
-
sensiolabs symfony, cloud foundry routing +1 more
Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization
CVE-2026-48784
Fix available
5.1 Medium
-
sensiolabs symfony, symfony html-sanitizer +1 more
Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense
CVE-2026-48760
Fix available
5.3 Medium
-
sensiolabs symfony, symfony mailomat-mailer +1 more
Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade
CVE-2026-48747
Fix available
6.3 Medium
-
sensiolabs symfony, actions http-client, symfony http-foundation +2 more
Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient
CVE-2026-48736
Fix available
6.9 Medium
-
sensiolabs symfony, symfony security-http +1 more
Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
CVE-2026-48489
Fix available
8.7 High
-
sensiolabs symfony, symfony html-sanitizer +1 more
Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> content
CVE-2026-48761
Fix available
5.3 Medium
-
jetbrains runtime, sensiolabs symfony +1 more
Symfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch
CVE-2026-47767
Fix available
8.3 High
-
symfony twig
Twig Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points
CVE-2026-47732
Fix available
7.1 High
-
symfony twig
Twig: XSS in profiler HtmlDumper via unescaped template and profile names
CVE-2026-47730
Fix available
5.1 Medium
-
sensiolabs symfony, symfony twilio-notifier +1 more
Symfony: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event Injection
CVE-2026-47212
Fix available
6.9 Medium
-
symfony polyfill, polyfill-intl-idn +1 more
symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence
CVE-2026-46644
Fix available
6.9 Medium
-
sensiolabs symfony, symfony json-path +1 more
Symfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS
CVE-2026-45756
Fix available
8.2 High
-
sensiolabs symfony, /mailtrap-mailer mailtrap-mailer +1 more
Symfony: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection
CVE-2026-45755
Fix available
6.9 Medium
-
sensiolabs symfony, symfony lox24-notifier, mailjet-mailer +2 more
Symfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection
CVE-2026-45754
Fix available
6.9 Medium
-
sensiolabs symfony, symfony html-sanitizer +1 more
Symfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS)
CVE-2026-45753
Fix available
2.1 Low
- Show olderLoading…