Vulnerabilidades en symfony
66 resultadosCVE-2026-45754MEDIUMSymfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event InjectionEPSS 0.4%CVE-2026-45075HIGHSymfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]EPSS 0.4%CVE-2024-51736NONECommand execution hijack on Windows with Process class in symfony/processEPSS 0.4%CVE-2026-49208MEDIUMSymfony UX: Format-less date LiveProps parsed with the permissive DateTime constructorEPSS 0.4%CVE-2026-45070MEDIUMSymfony: Email Header Injection via Non-Token Characters in Mime Parameter NamesEPSS 0.4%CVE-2026-45065LOWSymfony: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL InjectionEPSS 0.3%CVE-2026-48784MEDIUMSymfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 NormalizationEPSS 0.3%CVE-2026-45063CRITICALSymfony: Identity Spoofing via Unanchored DN Regex in X509AuthenticatorEPSS 0.3%CVE-2026-48760MEDIUMSymfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing DefenseEPSS 0.3%CVE-2026-49210LOWSymfony UX: XSS in symfony/ux-live-component via attacker-controlled child component tagEPSS 0.3%CVE-2026-55877MEDIUMSymfony UX: XSS in symfony/ux-icons via unsanitized SVG content in local files and Iconify on-demand responsesEPSS 0.3%CVE-2026-45064LOWSymfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href SpoofingEPSS 0.3%CVE-2026-45066LOWSymfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> MisclassificationEPSS 0.3%CVE-2026-49216MEDIUMSymfony UX: XSS in symfony/ux-autocomplete via unescaped AJAX response dataEPSS 0.3%CVE-2024-50341LOWSecurity::login does not take into account custom user_checker in symfony/security-bundleEPSS 0.3%CVE-2026-45072LOWSymfony: Stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File RenderingEPSS 0.3%CVE-2026-45755MEDIUMSymfony: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event InjectionEPSS 0.3%CVE-2026-48761MEDIUMSymfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> contentEPSS 0.3%CVE-2026-45069HIGHSymfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp ClaimsEPSS 0.3%CVE-2026-45753LOWSymfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS)EPSS 0.3%