62 matches found
CVE-2026-48761
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlAttributeSanitizer::getSupportedAttributes omitted URL-bearing attributes on , , , and , and URLs inside content bypassed URL sanitization, allowing...
CVE-2026-45075 Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, method-scoped IsGranted, IsSignatureValid, and IsCsrfTokenValid attributes can be configured for GET only, but Symfony routes HEAD requests to the GET handler while the...
CVE-2026-45075
Summary : Symfony's GET-only method checks in #[IsGranted], #[IsSignatureValid], and #[IsCsrfTokenValid] can be bypassed by HEAD requests, causing header leakage and potential side effects as HEAD is routed to the GET handler. This affects Symfony framework versions prior to 7.4.12 and 8.0.12. Im...
Linux Distros Unpatched Vulnerability : CVE-2026-48761
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13,...
Cross-site Scripting (XSS)
Overview symfony/symfony is a PHP framework for web applications and a set of reusable PHP components. Affected versions of this package are vulnerable to Cross-site Scripting XSS via HtmlSanitizer due to improper sanitization of URL attributes on object, applet, iframe, img and meta refresh. By...
Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation
More info at https://symfony.com/cve-2026-46640...
Astra Linux – Vulnerability in symfony
Symfony is a PHP framework for web and console applications, along with a set of reusable PHP components. The Symfony HTTP cache system functions as a reverse proxy: it caches entire responses including headers and returns them to clients. In a recent change to the AbstractSessionListener,...
Improper Input Validation
Symfony is vulnerable to improper input validation. The vulnerability is due to incorrect interpretation of PATHINFO in the Request class, which allows an attacker to bypass access control mechanisms by crafting URLs that do not start with a /...
Symfony 安全漏洞
Symfony is a PHP framework for web and console applications and a set of reusable PHP components from Symfony, Inc. A security vulnerability exists in Symfony versions prior to 5.4.50, 6.4.29, and 7.3.7, which stems from improper parsing of PATHINFO and could lead to bypassing access control rule...
EUVD-2020-0351
Malware in sbrugna...
EUVD-2019-0806
Malware in sbrugna...
EUVD-2020-0317
Malware in sbrugna...
EUVD-2020-0300
Malware in sbrugna...
EUVD-2019-0807
Malware in sbrugna...
EUVD-2019-0777
Malware in sbrugna...
EUVD-2022-5125
Malicious code in bioql PyPI...
EUVD-2024-3302
Malicious code in bioql PyPI...
EUVD-2022-1515
Malicious code in bioql PyPI...