sensiolabs vulnerabilities

Newest CVEs

• CVE-2026-123824

  Symfony: XXE (Local File Read) in Config XmlUtils::parse() via validateOnParse = true

  sensiolabs · symfony

  Low2.3
• CVE-2026-122053

  Symfony: ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested Objects

  sensiolabs · symfony

  Medium6.9
• CVE-2026-118515

  Symfony: The Serializer Builds UploadedFile Objects From Request Data, Letting a Client Point an Upload at Any Server File

  sensiolabs · symfony

  High8.4
• CVE-2026-121623

  Symfony: DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files, Letting a Client Read Any Server File

  sensiolabs · symfony

  High8.2
• CVE-2026-123792

  Symfony: Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document Hold a Process

  sensiolabs · symfony

  High8.7
• CVE-2026-123339

  Symfony: Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main Request

  sensiolabs · symfony

  Low2.3
• CVE-2026-123746

  Symfony: Programmatic Logins Skip the checkPostAuth() Method of User Checkers

  sensiolabs · symfony

  Low2.3
• CVE-2026-121949

  Symfony: HtmlSanitizer Does Not URL-Sanitize srcset and imagesrcset: Media Scheme and Host Allow-List Bypass

  sensiolabs · symfony

  Low2.3
• CVE-2026-118517

  Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority (Incomplete Fix for CVE-2026-45066)

  sensiolabs · symfony

  Low2.3
• CVE-2026-123125

  Symfony: Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses allowing SSRF Filter Bypass

  sensiolabs · symfony

  Medium6.3