CVE-2026-122053

The Symfony Serializer component's ObjectNormalizer is vulnerable to a property-path traversal issue in versions 5.4.41 to 5.4.55 , 6.4.9 to 6.4.49 , 7.0.9 to 7.1.0 , 7.1.2 to 7.4.22 , and 8.x prior to 8.1.11 . The vulnerability arises because ObjectNormalizer treats attribute names containing . ...

CVE-2026-122053 Symfony: ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested Objects

The Symfony Serializer component ObjectNormalizer treats any attribute name containing . and, from Symfony 6.4, as a writable property path, allowing untrusted input to modify properties of nested objects and bypass their Ignore metadata attribute in Symfony versions 5.4.41 prior to 5.4.56, 6.4.9...

CVE-2025-55182

Understanding React Server Components and the Flight Protocol React Server Components is a feature introduced in React 19 that allows components to be rendered on the server instead of in the client's browser. The server can handle complex computational tasks while only sending the rendered resul...