CVE-2026-48736 Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.0 to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, NoPrivateNetworkHttpClient and IpUtils::PRIVATESUBNETS omitted IPv6 transition prefixes such as 6to4, NAT64, Teredo, and IPv4-compatible IPv6, allowi...

CVE-2026-47303

Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network...

CVE-2026-47304

Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-47304

Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-47302

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network...

CVE-2026-47302

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network...

EUVD-2026-44139

Improper authorization in Active Directory Certificate Services AD CS allows an authorized attacker to elevate privileges over a network...

EUVD-2026-44072

Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network...

EUVD-2026-44074

Missing authentication for critical function in Windows Server Update Service allows an authorized attacker to elevate privileges over a network...

EUVD-2026-44068

Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over a network...

EUVD-2026-43878

Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over an adjacent network...

EUVD-2026-44043

Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network...

EUVD-2026-44026

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network...

EUVD-2026-44024

Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network...

EUVD-2026-44020

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows TCP/IP allows an unauthorized attacker to execute code over an adjacent network...

EUVD-2026-44001

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network...

EUVD-2026-44015

Integer underflow wrap or wraparound in Reliable Multicast Transport Driver RMCAST allows an unauthorized attacker to execute code over an adjacent network...

EUVD-2026-43994

Relative path traversal in Age of Empires II: Definitive Edition Game allows an unauthorized attacker to execute code over a network...

EUVD-2026-43767

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network...

EUVD-2026-44028

Improper authentication in Azure Spring Apps allows an authorized attacker to elevate privileges over a network...