symfony ux vulnerabilities
10 published CVEs name symfony ux among the affected products.
- 10Published CVEs10 of them scored
- 9Last 12 monthspublished in the last year
- 0Critical1 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-49215
Symfony UX: CSRF Protection Bypass in symfony/ux-live-component — Accept Header is CORS-Safelisted
symfony · ux
Low2.1 - CVE-2026-49216
Symfony UX: XSS in symfony/ux-autocomplete via unescaped AJAX response data
symfony · ux
Medium5.1 - CVE-2026-49211
Symfony UX: Information exposure via unescaped LIKE wildcards in EntitySearchUtil
symfony · ux
Medium6.9 - CVE-2026-49208
Symfony UX: Format-less date LiveProps parsed with the permissive DateTime constructor
symfony · ux
Medium6.9 - CVE-2026-49210
Symfony UX: XSS in symfony/ux-live-component via attacker-controlled child component tag
symfony · ux
Low2.3 - CVE-2026-49212
Symfony UX: LiveComponentHydrator HMAC checksum lacks component and slot binding
symfony · ux
Medium6.9 - CVE-2026-49209
Symfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requests
symfony · ux
Medium5.3 - CVE-2026-55877
Symfony UX: XSS in symfony/ux-icons via unsanitized SVG content in local files and Iconify on-demand responses
symfony · ux
Medium6.1 - CVE-2026-55878
Symfony: Path Traversal in symfony/ux-toolkit Allows Arbitrary File Write and Read via Crafted Recipe Manifest
symfony · ux
High7.8 - CVE-2025-47946
symfony/ux-live-component and symfony/ux-twig-component vulnerable to unsanitized HTML attribute injection via ComponentAttributes
symfony · ux
Medium6.1