Advisories for packages from symfony

Listing reported advisories for packages from symfony sorted by their report date.

Symfony: Twilio SMS Notifier allows unauthenticated webhook injection due to missing X-Twilio-Signature verification
GitHub

symfony/symfony

>= 8.0.0, < 8.0.12 · >= 7.0.0, < 7.4.12 · >= 6.4.0, < 6.4.40

2026-05-29 21:32:26
symfony/polyfill-intl-idn: xn-- labels with ASCII-only Punycode payloads are treated as equivalent to their decoded form
GitHub

symfony/polyfill

>= 1.17.1, < 1.38.1

2026-05-28 19:52:37
Symfony's JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS
GitHub

symfony/json-path

>= 8.0.0, < 8.0.12 · >= 7.3.0, < 7.4.12

2026-05-28 17:34:56
Symfony's Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection
GitHub

symfony/mailtrap-mailer

>= 8.0.0, < 8.0.12 · >= 7.2.0, < 7.4.12

2026-05-28 17:33:48
Symfony's Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection
GitHub

symfony/lox24-notifier

>= 8.0.0, < 8.0.12 · >= 7.1.0, < 7.4.12 · >= 7.0.0, < 7.4.12 · >= 6.4.0, < 6.4.40

2026-05-28 17:22:37
Symfony's HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — `javascript`: URI Survives Sanitization (XSS)
GitHub

symfony/html-sanitizer

>= 8.0.0, < 8.0.12 · >= 7.0.0, < 7.4.12 · >= 6.1.0, < 6.4.40

2026-05-28 16:43:28
Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex
GitHub

symfony/yaml

>= 8.0.0, < 8.0.12 · >= 7.0.0, < 7.4.12 · >= 6.0.0, < 6.4.40 · < 5.4.52

2026-05-27 21:34:37
Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")
GitHub

symfony/yaml

>= 8.0.0, < 8.0.12 · >= 7.0.0, < 7.4.12 · >= 6.0.0, < 6.4.40 · < 5.4.52

2026-05-27 21:33:52
Symfony hardened the parser when handling untrusted input
GitHub

symfony/yaml

>= 8.0.0, < 8.0.12 · >= 7.0.0, < 7.4.12 · >= 6.0.0, < 6.4.40 · < 5.4.52

2026-05-27 21:33:09
Symfony has Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener
GitHub

symfony/monolog-bridge

>= 8.0.0, < 8.0.12 · >= 7.0.0, < 7.4.12 · >= 6.0.0, < 6.4.40 · < 5.4.52

2026-05-27 21:13:31
Synfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
GitHub

symfony/http-kernel

>= 8.0.0, < 8.0.12 · >= 7.4.0, < 7.4.12

2026-05-27 21:12:39
Symfony's Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay
GitHub

symfony/security-http

>= 8.0.0, < 8.0.12 · >= 7.1.0, < 7.4.12

2026-05-27 21:12:00
Symfony Vulnerable to SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix
GitHub

symfony/cache

>= 8.0.0, < 8.0.12 · >= 7.0.0, < 7.4.12 · >= 6.0.0, < 6.4.40 · < 5.4.52

2026-05-27 21:11:23
Symfony Vulnerable to stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering
GitHub

symfony/symfony

>= 6.4.24, < 6.4.40 · >= 8.0.0, < 8.0.12 · >= 7.2.9, < 7.4.12

2026-05-27 21:10:45
Symfony has XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true
GitHub

symfony/dom-crawler

>= 8.0.0, < 8.0.12 · >= 7.0.0, < 7.4.12 · >= 6.0.0, < 6.4.40 · < 5.4.52

2026-05-27 21:09:45
Symfony has Email Header Injection via Non-Token Characters in Mime Parameter Names
GitHub

symfony/mime

>= 8.0.0, < 8.0.12 · >= 7.0.0, < 7.4.12 · >= 6.0.0, < 6.4.40 · < 5.4.52

2026-05-27 21:09:13
Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims
GitHub

symfony/security-http

>= 8.0.0, < 8.0.12 · >= 7.4.0, < 7.4.12 · >= 6.3.0, < 6.4.40

2026-05-27 21:03:38
Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address
GitHub

symfony/mailer

>= 8.0.0, < 8.0.12 · >= 7.0.0, < 7.4.12 · >= 6.0.0, < 6.4.40 · < 5.4.52

2026-05-27 20:46:06
Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
GitHub

symfony/mime

>= 8.0.0, < 8.0.12 · >= 7.0.0, < 7.4.12 · >= 6.0.0, < 6.4.40 · < 5.4.52

2026-05-27 20:42:08
Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification
GitHub

symfony/html-sanitizer

>= 8.0.0, < 8.0.12 · >= 7.0.0, < 7.4.12 · >= 6.1.0, < 6.4.40

2026-05-27 20:13:05
Symfony's HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing
GitHub

symfony/html-sanitizer

>= 8.0.0, < 8.0.12 · >= 7.0.0, < 7.4.12 · >= 6.1.0, < 6.4.40

2026-05-27 20:04:23
Symfony has a UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection
GitHub

symfony/routing

>= 8.0.0, < 8.0.12 · >= 7.0.0, < 7.4.12 · >= 6.0.0, < 6.4.40 · < 5.4.52

2026-05-27 16:55:18
Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator
GitHub

symfony/security-http

>= 8.0.0-BETA1, < 8.0.12 · >= 7.0.0-BETA1, < 7.4.12 · >= 6.0.0-BETA1, < 6.4.40 · < 5.4.52

2026-05-27 16:51:09
CVE-2026-48784: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization
FriendsOfPHP

symfony/routing

>=8.0.0, <8.0.13 · >=7.4.0, <7.4.13 · >=6.4.0, <6.4.41 · >=5.4.0, <5.4.53 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2026-05-26 08:00:00
CVE-2026-48489: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
FriendsOfPHP

symfony/security-http

>=8.0.0, <8.0.13 · >=7.4.0, <7.4.13 · >=6.4.0, <6.4.41 · >=5.4.0, <5.4.53 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2026-05-26 08:00:00
CVE-2026-48489: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
FriendsOfPHP

symfony/symfony

>=8.0.0, <8.0.13 · >=7.4.0, <7.4.13 · >=6.4.0, <6.4.41 · >=5.4.0, <5.4.53 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2026-05-26 08:00:00
CVE-2026-46644: symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence
FriendsOfPHP

symfony/polyfill-intl-idn

>=1.17.1, <1.38.1

2026-05-26 08:00:00
CVE-2026-46644: symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence
FriendsOfPHP

symfony/polyfill

>=1.17.1, <1.38.1

2026-05-26 08:00:00
CVE-2026-48736: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient
FriendsOfPHP

symfony/symfony

>=8.0.0, <8.0.13 · >=7.4.0, <7.4.13 · >=6.4.0, <6.4.41 · >=5.4.0, <5.4.53 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0

2026-05-26 08:00:00
CVE-2026-48747: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade
FriendsOfPHP

symfony/symfony

>=8.0.0, <8.0.13 · >=7.4.0, <7.4.13 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0

2026-05-26 08:00:00
CVE-2026-48760: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense
FriendsOfPHP

symfony/symfony

>=8.0.0, <8.0.13 · >=7.4.0, <7.4.13 · >=6.4.0, <6.4.41 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0

2026-05-26 08:00:00
CVE-2026-48747: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade
FriendsOfPHP

symfony/mailomat-mailer

>=8.0.0, <8.0.13 · >=7.4.0, <7.4.13 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0

2026-05-26 08:00:00
CVE-2026-48761: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> content
FriendsOfPHP

symfony/symfony

>=8.0.0, <8.0.13 · >=7.4.0, <7.4.13 · >=6.4.0, <6.4.41 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0

2026-05-26 08:00:00
CVE-2026-48784: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization
FriendsOfPHP

symfony/symfony

>=8.0.0, <8.0.13 · >=7.4.0, <7.4.13 · >=6.4.0, <6.4.41 · >=5.4.0, <5.4.53 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2026-05-26 08:00:00
CVE-2026-48736: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient
FriendsOfPHP

symfony/http-foundation

>=8.0.0, <8.0.13 · >=7.4.0, <7.4.13 · >=6.4.0, <6.4.41 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0

2026-05-26 08:00:00
CVE-2026-48761: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> content
FriendsOfPHP

symfony/html-sanitizer

>=8.0.0, <8.0.13 · >=7.4.0, <7.4.13 · >=6.4.0, <6.4.41 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0

2026-05-26 08:00:00
CVE-2026-48760: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense
FriendsOfPHP

symfony/html-sanitizer

>=8.0.0, <8.0.13 · >=7.4.0, <7.4.13 · >=6.4.0, <6.4.41 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0

2026-05-26 08:00:00
CVE-2026-48736: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient
FriendsOfPHP

symfony/http-client

>=5.4.0, <5.4.53

2026-05-26 08:00:00
CVE-2026-45068: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address
FriendsOfPHP

symfony/mailer

>=8.0.0, <8.0.12 · >=7.4.0, <7.4.12 · >=6.4.0, <6.4.40 · >=5.4.0, <5.4.52 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2026-05-20 08:00:00
CVE-2026-45067: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
FriendsOfPHP

symfony/mime

>=8.0.0, <8.0.12 · >=7.4.0, <7.4.12 · >=6.4.0, <6.4.40 · >=5.4.0, <5.4.52 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2026-05-20 08:00:00
CVE-2026-45075: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
FriendsOfPHP

symfony/symfony

>=8.0.0, <8.0.12 · >=7.4.0, <7.4.12

2026-05-20 08:00:00
CVE-2026-45074: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay
FriendsOfPHP

symfony/symfony

>=8.0.0, <8.0.12 · >=7.4.0, <7.4.12 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0

2026-05-20 08:00:00
CVE-2026-45073: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix
FriendsOfPHP

symfony/symfony

>=8.0.0, <8.0.12 · >=7.4.0, <7.4.12 · >=6.4.0, <6.4.40 · >=5.4.0, <5.4.52 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2026-05-20 08:00:00
CVE-2026-45755: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC: Unauthenticated Webhook Event Injection
FriendsOfPHP

symfony/mailtrap-mailer

>=8.0.0, <8.0.12 · >=7.4.0, <7.4.12 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0

2026-05-20 08:00:00
CVE-2026-45072: Stored XSS in WebProfiler CodeExtension::fileExcerpt(): Unescaped Non-PHP File Rendering
FriendsOfPHP

symfony/symfony

>=6.4.24, <6.4.40 · >=8.0.0, <8.0.12 · >=7.4.0, <7.4.12 · >=7.3.0, <7.4.0 · >=7.2.9, <7.3.0

2026-05-20 08:00:00
CVE-2026-45754: Mailjet Mailer and LOX24 Notifier Webhook Parsers Never Verify the Configured Secret: Unauthenticated Webhook Event Injection
FriendsOfPHP

symfony/mailjet-mailer

>=8.0.0, <8.0.12 · >=7.4.0, <7.4.12 · >=6.4.0, <6.4.40 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0

2026-05-20 08:00:00
CVE-2026-45071: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true
FriendsOfPHP

symfony/symfony

>=8.0.0, <8.0.12 · >=7.4.0, <7.4.12 · >=6.4.0, <6.4.40 · >=5.4.0, <5.4.52 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2026-05-20 08:00:00
CVE-2026-45756: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits: ReDoS
FriendsOfPHP

symfony/json-path

>=8.0.0, <8.0.12 · >=7.4.0, <7.4.12 · >=7.3.0, <7.4.0

2026-05-20 08:00:00
CVE-2026-45753: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite: javascript: URI Survives Sanitization (XSS)
FriendsOfPHP

symfony/html-sanitizer

>=8.0.0, <8.0.12 · >=7.4.0, <7.4.12 · >=6.4.0, <6.4.40 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0

2026-05-20 08:00:00
CVE-2026-45075: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
FriendsOfPHP

symfony/http-kernel

>=8.0.0, <8.0.12 · >=7.4.0, <7.4.12

2026-05-20 08:00:00
« Previous Next »

Showing 1 to 50 of 340 results

1 2 3 4 5 6 7