Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: sensiolabs symfony 6.4.50, 7.4.23, 8.1.11 Clear all filters
TI-2026-85550 CVE-2026-121949

Symfony HtmlSanitizer skips URL checks on srcset and imagesrcset

Priority LOW 12

The Symfony HtmlSanitizer component does not apply the media URL policy to the srcset and imagesrcset attributes, allowing values that point to hosts or schemes not permitted by allowMediaSchemes() or allowMediaHosts() t…

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00239 Published 2026-11-05 Fixed CWE-1023
TI-2026-85519 CVE-2026-118517

Host allow-list bypass in Symfony HtmlSanitizer via malformed URLs

Priority MEDIUM 45

The Symfony HtmlSanitizer component UrlSanitizer parses URLs differently from browsers, allowing the allowLinkHosts() and allowMediaHosts() checks to be bypassed for URLs without a well-formed authority, resulting in unt…

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00262 Published 2026-11-05 Fixed CWE-184