Advisories · Technology
sensiolabs symfony.
Every CVE that names sensiolabs symfony among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 2.3 Low
Symfony: HtmlSanitizer Does Not URL-Sanitize srcset and imagesrcset: Media Scheme and Host Allow-List Bypass
- sensiolabs symfony
- CWE-184
- CWE-1023
- CVSS 6.3 Medium
Symfony: Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses allowing SSRF Filter Bypass
- sensiolabs symfony
- Server-side request forgery (SSRF)
- CWE-184
- CVSS 2.3 Low
Symfony: NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports (Incomplete Fix for CVE-2024-50342)
- sensiolabs symfony
- Race condition
- Server-side request forgery (SSRF)
- CVSS 8.2 High
Symfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References
- sensiolabs symfony
- Information disclosure
- Hard-coded credentials
- CVSS 5.3 Medium
Symfony: HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar (Incomplete Fix for CVE-2026-48761)
- sensiolabs symfony
- Open redirect
- CWE-186