TI-2026-36412 CVE-2026-49211 · GHSA-946h-jp5c-8fvh
Symfony UX: Information exposure via unescaped LIKE wildcards in EntitySearchUtil
Priority LOW 37
Symfony UX is a JavaScript ecosystem for Symfony.
symfony
Records95All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high36CVSS 7.0–8.9
Exploited now
symfony records in CISA KEVNo symfony vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
8 records in Ux · all components
TI-2026-36409 CVE-2026-49208 · GHSA-89g7-22c8-3j23
Symfony UX: Format-less date LiveProps parsed with the permissive DateTime constructor
Priority LOW 37
Symfony UX is a JavaScript ecosystem for Symfony.
TI-2026-36413 CVE-2026-49212 · GHSA-34w5-c283-j9fg
Symfony UX: LiveComponentHydrator HMAC checksum lacks component and slot binding
Priority LOW 36
Symfony UX is a JavaScript ecosystem for Symfony.
TI-2026-40330 CVE-2026-55877 · GHSA-6v8j-33hc-mv84
Symfony UX: XSS in symfony/ux-icons via unsanitized SVG content in local files and Iconify on-demand responses
Priority LOW 27
Symfony UX is a JavaScript ecosystem for Symfony.
TI-2026-36410 CVE-2026-49209 · GHSA-mm82-c99c-h2cf
Symfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requests
Priority LOW 25
Symfony UX is a JavaScript ecosystem for Symfony.
TI-2026-36417 CVE-2026-49216 · GHSA-mwqm-4fw3-cjvr
Symfony UX: XSS in symfony/ux-autocomplete via unescaped AJAX response data
Priority LOW 23
Symfony UX is a JavaScript ecosystem for Symfony.
TI-2026-36411 CVE-2026-49210 · GHSA-38x5-rcv4-xf7x
Symfony UX: XSS in symfony/ux-live-component via attacker-controlled child component tag
Priority LOW 12
Symfony UX is a JavaScript ecosystem for Symfony.
TI-2026-36416 CVE-2026-49215 · GHSA-4m4j-hmqq-3gxm
Symfony UX: CSRF Protection Bypass in symfony/ux-live-component — Accept Header is CORS-Safelisted
Priority LOW 10
Symfony UX is a JavaScript ecosystem for Symfony.