symfony vulnerabilities

CVEs per yearBy the year they were published

1. 20204
2. 20215
3. 20221
4. 20236
5. 20247
6. 20252
7. 202641

Newest CVEs

• CVE-2026-118514

  Symfony: HEAD Requests Bypass the methods Option of security.access_control Rules and Firewalls

  symfony · symfony

  Medium6.3
• CVE-2026-49215

  Symfony UX: CSRF Protection Bypass in symfony/ux-live-component — Accept Header is CORS-Safelisted

  symfony · ux

  Low2.1
• CVE-2026-49216

  Symfony UX: XSS in symfony/ux-autocomplete via unescaped AJAX response data

  symfony · ux

  Medium5.1
• CVE-2026-49211

  Symfony UX: Information exposure via unescaped LIKE wildcards in EntitySearchUtil

  symfony · ux

  Medium6.9
• CVE-2026-49208

  Symfony UX: Format-less date LiveProps parsed with the permissive DateTime constructor

  symfony · ux

  Medium6.9
• CVE-2026-49210

  Symfony UX: XSS in symfony/ux-live-component via attacker-controlled child component tag

  symfony · ux

  Low2.3
• CVE-2026-49212

  Symfony UX: LiveComponentHydrator HMAC checksum lacks component and slot binding

  symfony · ux

  Medium6.9
• CVE-2026-49209

  Symfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requests

  symfony · ux

  Medium5.3
• CVE-2026-46644

  symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence

  symfony · polyfill

  Medium6.9
• CVE-2026-48761

  Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> content

  symfony · symfony

  Medium5.3