Approved changes feed: RSS · Atom
cpe:2.3:a:symfony:symfony:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Symfony (88011d02-04e0-53e8-bc79-472f99951c29) |
|---|---|
| Product | Symfony (bb798242-a941-5118-9653-4326250ef938) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:composer/symfony/symfony |
purl2cpe | 2026-06-01 10:16:41.520446 |
pkg:github/symfony/symfony |
purl2cpe | 2026-06-01 10:16:41.520449 |
pkg:golang/github.com/symfony/symfony |
purl2cpe | 2026-06-01 10:16:41.520450 |
pkg:sourceforge/symfony.mirror |
purl2cpe | 2026-06-01 10:16:41.520452 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-48761 |
vulnerable | 2026-07-29 00:55:01.613881 |
Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> content
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlAttributeSanitizer::getSupportedAttributes() omitted URL-bearing attributes on <object>, <applet>, <iframe>, and <img>, and <meta http-equiv="refresh"> URLs inside content bypassed URL sanitization, allowing explicitly enabled elements or attributes to pass javascript: and similar payloads into sanitized output. This issue is fixed in versions 6.4.41, 7.4.13, and 8.0.13.
Published: 2026-07-14T19:21:26.582Z
Updated: 2026-07-21T18:02:30.352Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-48760 |
vulnerable | 2026-07-29 00:55:01.613368 |
Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlSanitizer::parse() rejected raw BiDi formatting characters but not percent-encoded forms and used an ASCII-only whitespace check, allowing sanitized URLs to retain visual-spoofing characters that downstream consumers could decode or display. This issue is fixed in versions 6.4.41, 7.4.13, and 8.0.13.
Published: 2026-07-14T19:11:42.179Z
Updated: 2026-07-15T14:36:03.339Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-48747 |
vulnerable | 2026-07-29 00:55:01.604549 |
Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.13 and 8.0.13, MailomatRequestParser::validateSignature() parsed X-MOM-Webhook-Signature as algo=signature and passed the request-selected algorithm to hash_hmac(), allowing a signature algorithm downgrade instead of enforcing Mailomat's documented SHA-256 webhook signature. This issue is fixed in versions 7.4.13 and 8.0.13.
Published: 2026-07-14T19:16:24.327Z
Updated: 2026-07-15T14:22:53.743Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-48736 |
vulnerable | 2026-07-29 00:55:01.596537 |
Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.0 to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBNETS omitted IPv6 transition prefixes such as 6to4, NAT64, Teredo, and IPv4-compatible IPv6, allowing attacker-supplied URLs to represent private IPv4 targets in forms that IpUtils::isPrivateIp() did not block. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.
Published: 2026-07-14T19:09:30.260Z
Updated: 2026-07-15T13:23:06.394Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-48489 |
vulnerable | 2026-07-29 00:55:01.349626 |
Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, DefaultAuthenticationFailureHandler honored the request-supplied _failure_path parameter when failure_forward: true was enabled, allowing an unauthenticated failing login request to dispatch a subrequest to access_control-protected GET routes that skipped firewall listeners. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.
Published: 2026-07-14T19:14:12.233Z
Updated: 2026-07-16T14:40:10.013Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-47767 |
vulnerable | 2026-07-29 00:55:00.402610 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-45756 |
vulnerable | 2026-07-29 00:54:58.510952 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-45754 |
vulnerable | 2026-07-29 00:54:58.502698 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-45753 |
vulnerable | 2026-07-29 00:54:58.496571 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-45077 |
vulnerable | 2026-07-29 00:52:15.067059 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-45075 |
vulnerable | 2026-07-29 00:52:15.061922 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-45074 |
vulnerable | 2026-07-29 00:52:15.059029 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-45073 |
vulnerable | 2026-07-29 00:52:15.054712 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-45071 |
vulnerable | 2026-07-29 00:52:15.051884 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-45070 |
vulnerable | 2026-07-29 00:52:15.049343 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-45068 |
vulnerable | 2026-07-29 00:52:15.046117 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-45066 |
vulnerable | 2026-07-29 00:52:15.045802 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-45064 |
vulnerable | 2026-07-29 00:52:15.038396 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-45063 |
vulnerable | 2026-07-29 00:52:15.037905 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-24739 |
vulnerable | 2026-06-08 07:51:18.100554 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-64500 |
vulnerable | 2026-06-08 07:39:19.856556 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-51996 |
vulnerable | 2026-06-08 06:52:14.561873 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-51736 |
vulnerable | 2026-06-08 06:52:12.752058 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-50345 |
vulnerable | 2026-06-08 06:52:09.703772 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-50343 |
vulnerable | 2026-06-08 06:52:09.699546 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-50342 |
vulnerable | 2026-06-08 06:52:09.697117 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-50341 |
vulnerable | 2026-06-08 06:52:09.696682 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-50340 |
vulnerable | 2026-06-08 06:52:09.696177 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-36611 |
vulnerable | 2026-06-08 06:39:45.541505 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-46735 |
vulnerable | 2026-06-08 06:14:23.077788 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-46734 |
vulnerable | 2026-06-08 06:14:23.075433 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-46733 |
vulnerable | 2026-06-08 06:14:23.073776 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-24895 |
vulnerable | 2026-06-08 05:41:44.851089 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-24894 |
vulnerable | 2026-06-08 05:41:44.849993 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-23601 |
vulnerable | 2026-06-08 05:40:57.803821 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-41270 |
vulnerable | 2026-06-08 05:35:20.080656 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-41268 |
vulnerable | 2026-06-08 05:35:20.077130 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-41267 |
vulnerable | 2026-06-08 05:35:20.075792 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-32693 |
vulnerable | 2026-06-08 05:32:07.849711 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21424 |
vulnerable | 2026-06-08 05:29:12.000389 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-5275 |
vulnerable | 2026-06-08 05:26:41.654062 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-5274 |
vulnerable | 2026-06-08 05:26:41.653554 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-5255 |
vulnerable | 2026-06-08 05:26:41.609747 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-15094 |
vulnerable | 2026-06-08 05:19:25.248831 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.