Advisories · Weakness
CWE-1007.
Every Advisory and CVE whose sources give the weakness CWE-1007, newest first.
- CVSS 5.3 Medium
Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense
- CWE-451
- CWE-1007
>=6.1.0, <6.4.41 || >=7.0.0, <7.4.13 || >=8.0.0, <8.0.13 · fixed in 6.4.41, 7.4.13, 8.0.13
GHSA-v3wm-qf9p-c549 · CVE-2026-48760 - CVSS 2.3 Low
Symfony's HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing
- CWE-451
- CWE-1007
>=6.1.0, <6.4.40 || >=7.0.0, <7.4.12 || >=8.0.0, <8.0.12 · fixed in 6.4.40, 7.4.12, 8.0.12
GHSA-h5vq-qfcg-4m6p · CVE-2026-45064 - CVSS 8.7 High
Homograph attack allows Unicode lookalike characters to bypass validation.
- CWE-1007
<3.0.11 || >=4.0.0, <4.0.1 || >=5.0.0, <5.0.1 · fixed in 3.0.11, 4.0.1, 5.0.1
GHSA-xq7p-g2vc-g82p · CVE-2025-27611 - CVSS 5.4 Medium
Google Chrome: Inappropriate implementation in Browser UI in Google Chrome on Android prior to…
- Google Chrome
- CWE-1007
- CVSS 4.3 Medium
Mozilla Firefox: If a domain name contained a RTL character…
- Mozilla Firefox
- CWE-1007