Priority LOW 29
In Symfony http-foundation prior to versions 5.4.56, 6.4.50, 7.4.23, and 8.1.11, Symfony\Component\HttpFoundation\RequestMatcher, and RequestMatcher\MethodRequestMatcher which replaces it from 6.2.x on, matches a request…
Vulnerabilities
95 records
Priority MEDIUM 44
Twig is a template language for PHP.
TI-2026-36416 CVE-2026-49215 · GHSA-4m4j-hmqq-3gxm
Symfony UX: CSRF Protection Bypass in symfony/ux-live-component — Accept Header is CORS-Safelisted
Priority LOW 10
Symfony UX is a JavaScript ecosystem for Symfony.
TI-2026-36417 CVE-2026-49216 · GHSA-mwqm-4fw3-cjvr
Symfony UX: XSS in symfony/ux-autocomplete via unescaped AJAX response data
Priority LOW 23
Symfony UX is a JavaScript ecosystem for Symfony.
TI-2026-36412 CVE-2026-49211 · GHSA-946h-jp5c-8fvh
Symfony UX: Information exposure via unescaped LIKE wildcards in EntitySearchUtil
Priority LOW 37
Symfony UX is a JavaScript ecosystem for Symfony.
TI-2026-36409 CVE-2026-49208 · GHSA-89g7-22c8-3j23
Symfony UX: Format-less date LiveProps parsed with the permissive DateTime constructor
Priority LOW 37
Symfony UX is a JavaScript ecosystem for Symfony.
TI-2026-36411 CVE-2026-49210 · GHSA-38x5-rcv4-xf7x
Symfony UX: XSS in symfony/ux-live-component via attacker-controlled child component tag
Priority LOW 12
Symfony UX is a JavaScript ecosystem for Symfony.
TI-2026-36413 CVE-2026-49212 · GHSA-34w5-c283-j9fg
Symfony UX: LiveComponentHydrator HMAC checksum lacks component and slot binding
Priority LOW 36
Symfony UX is a JavaScript ecosystem for Symfony.
TI-2026-36410 CVE-2026-49209 · GHSA-mm82-c99c-h2cf
Symfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requests
Priority LOW 25
Symfony UX is a JavaScript ecosystem for Symfony.
TI-2026-36076 CVE-2026-48807 · GHSA-8x9c-rmqh-456c
Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters
Priority LOW 31
Twig is a template language for PHP.
TI-2026-36075 CVE-2026-48806 · GHSA-5v5v-ww74-355v
Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys
Priority LOW 32
Twig is a template language for PHP.
TI-2026-36077 CVE-2026-48808 · GHSA-h8vq-8gpg-mhcg
Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`
Priority LOW 27
Twig is a template language for PHP.
TI-2026-36074 CVE-2026-48805 · GHSA-p42q-9prx-q5wq
Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`
Priority LOW 33
Twig is a template language for PHP.
TI-2026-36814 CVE-2026-49981 · GHSA-529h-vh3j-85hq
Protection mechanism failure in symfony Twig
Priority LOW 27
Twig is a template language for PHP.
TI-2026-34289 CVE-2026-46637 · GHSA-jv8m-2544-3pg3
Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`
Priority LOW 23
Twig is a template language for PHP.
TI-2026-34290 CVE-2026-46638 · GHSA-7fxw-r6jv-74c8
Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)
Priority LOW 27
Twig is a template language for PHP.
TI-2026-34292 CVE-2026-46640 · GHSA-45vw-wh46-2vx8
Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation
Priority MEDIUM 41
Twig is a template language for PHP.
TI-2026-34284 CVE-2026-46629 · GHSA-35wc-cvqg-78fp
Twig: Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments
Priority LOW 25
Twig is a template language for PHP.
TI-2026-35231 CVE-2026-47730 · GHSA-2g2g-8p8h-fgwm
Twig: XSS in profiler HtmlDumper via unescaped template and profile names
Priority LOW 23
Twig is a template language for PHP.
TI-2026-34283 CVE-2026-46628 · GHSA-4j38-f5cw-54h7
Twig: The `spaceless` filter implicitly marks its output as safe
Priority MEDIUM 56
Twig is a template language for PHP.
TI-2026-34286 CVE-2026-46634 · GHSA-24x9-r6q4-q93w
Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name
Priority LOW 37
Twig is a template language for PHP.
Priority LOW 32
Twig is a template language for PHP.
TI-2026-34285 CVE-2026-46633 · GHSA-7p85-w9px-jpjp
Twig: PHP code injection via `{% use %}` template name
Priority MEDIUM 41
Twig is a template language for PHP.
TI-2026-34291 CVE-2026-46639 · GHSA-mm6w-gr99-p3jj
Twig: Sandbox property and method bypass via object-destructuring assignment
Priority LOW 31
Twig is a template language for PHP.
TI-2026-34287 CVE-2026-46635 · GHSA-vcc8-phrv-43wj
Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)
Priority LOW 24
Twig is a template language for PHP.