Vulnerabilidades em sensiolabs
18 resultadosAnálise Vexday
SensioLabs apresenta footprint reduzido de 3 CVEs, todas publicadas recentemente (últimos 90 dias), com nenhuma exploração ativa documentada e zero críticas. O padrão dominante é CWE-674 (recursão descontrolada), indicando vulnerabilidades de lógica aplicacional sem severidade crítica imediata, mas que requerem atenção dado o lançamento concentrado recente.
CVE-2026-121373MEDIUMSymfony: HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar (Incomplete Fix for CVE-2026-48761)EPSS 0.5%CVE-2026-108082HIGHSymfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request HeaderEPSS 0.5%CVE-2026-118516MEDIUMSymfony: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access ControlEPSS 0.4%CVE-2026-109413HIGHSymfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the ProcessEPSS 0.4%CVE-2026-109449HIGHSymfony: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the ProcessEPSS 0.4%CVE-2026-118513HIGHSymfony: X.509 Authentication Impersonation via DN Value Injection (incomplete fix for CVE-2026-45063)EPSS 0.3%CVE-2026-121971HIGHSymfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path ReferencesEPSS 0.2%CVE-2026-123824LOWSymfony: XXE (Local File Read) in Config XmlUtils::parse() via validateOnParse = trueEPSS —CVE-2026-118517LOWSymfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority (Incomplete Fix for CVE-2026-45066)EPSS —CVE-2026-121623HIGHSymfony: DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files, Letting a Client Read Any Server FileEPSS —CVE-2026-123792HIGHSymfony: Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document Hold a ProcessEPSS —CVE-2026-123339LOWSymfony: Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main RequestEPSS —CVE-2026-121949LOWSymfony: HtmlSanitizer Does Not URL-Sanitize srcset and imagesrcset: Media Scheme and Host Allow-List BypassEPSS —CVE-2026-122053MEDIUMSymfony: ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested ObjectsEPSS —CVE-2026-123125MEDIUMSymfony: Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses allowing SSRF Filter BypassEPSS —CVE-2026-118515HIGHSymfony: The Serializer Builds UploadedFile Objects From Request Data, Letting a Client Point an Upload at Any Server FileEPSS —CVE-2026-123746LOWSymfony: Programmatic Logins Skip the checkPostAuth() Method of User CheckersEPSS —CVE-2026-123119LOWSymfony: NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports (Incomplete Fix for CVE-2024-50342)EPSS —