{"schema_version":1,"title":"Symfony vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 39 vulnerabilities in Symfony: 0 in the last 7 days and 39 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-49216, was published on 17 July 2026. 5 technologies have a page of their own.","url":"https://junglewise.ai/threats/vendors/symfony","json_url":"https://junglewise.ai/threats/vendors/symfony.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/symfony","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":5,"all_time":39,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":39,"last_365_days":39},"latest":[{"cve":"CVE-2026-49216","cvss":4,"epss":0.0031,"slug":"cve-2026-49216-symfony-ux-autocomplete-xss-via-unescaped-ajax-response-data","title":"Symfony UX Autocomplete XSS via unescaped AJAX response data","severity":"medium","exploited":false,"published_at":"2026-07-17T17:17:16.19+00:00","url":"https://junglewise.ai/threats/cve-2026-49216-symfony-ux-autocomplete-xss-via-unescaped-ajax-response-data"},{"cve":"CVE-2026-49215","cvss":4,"epss":0.0018,"slug":"cve-2026-49215-symfony-ux-livecomponent-csrf-in-liveaction-invocations","title":"Symfony UX LiveComponent CSRF in LiveAction invocations","severity":"medium","exploited":false,"published_at":"2026-07-17T17:17:16.06+00:00","url":"https://junglewise.ai/threats/cve-2026-49215-symfony-ux-livecomponent-csrf-in-liveaction-invocations"},{"cve":"CVE-2026-49212","cvss":4,"epss":0.0024,"slug":"cve-2026-49212-symfony-ux-insufficient-verification-of-data-authenticity-in","title":"Symfony UX insufficient verification of data authenticity in LiveComponent","severity":"medium","exploited":false,"published_at":"2026-07-17T17:17:15.93+00:00","url":"https://junglewise.ai/threats/cve-2026-49212-symfony-ux-insufficient-verification-of-data-authenticity-in"},{"cve":"CVE-2026-49211","cvss":4,"epss":0.0053,"slug":"cve-2026-49211-symfony-ux-autocomplete-information-exposure-via-unescaped-like","title":"Symfony UX Autocomplete information exposure via unescaped LIKE wildcards","severity":"medium","exploited":false,"published_at":"2026-07-17T17:17:15.79+00:00","url":"https://junglewise.ai/threats/cve-2026-49211-symfony-ux-autocomplete-information-exposure-via-unescaped-like"},{"cve":"CVE-2026-49210","cvss":4,"epss":0.0034,"slug":"cve-2026-49210-symfony-ux-livecomponent-xss-via-unvalidated-child-component-tag","title":"Symfony UX LiveComponent XSS via unvalidated child component tag","severity":"medium","exploited":false,"published_at":"2026-07-17T17:17:15.65+00:00","url":"https://junglewise.ai/threats/cve-2026-49210-symfony-ux-livecomponent-xss-via-unvalidated-child-component-tag"},{"cve":"CVE-2026-49209","cvss":4,"epss":0.0056,"slug":"cve-2026-49209-symfony-ux-livecomponent-denial-of-service-in","title":"Symfony UX LiveComponent denial of service in BatchActionController","severity":"medium","exploited":false,"published_at":"2026-07-17T17:17:15.517+00:00","url":"https://junglewise.ai/threats/cve-2026-49209-symfony-ux-livecomponent-denial-of-service-in"},{"cve":"CVE-2026-49208","cvss":4,"epss":0.0041,"slug":"cve-2026-49208-symfony-ux-livecomponent-improper-input-validation-in-date","title":"Symfony UX LiveComponent improper input validation in date hydration","severity":"medium","exploited":false,"published_at":"2026-07-17T17:17:15.38+00:00","url":"https://junglewise.ai/threats/cve-2026-49208-symfony-ux-livecomponent-improper-input-validation-in-date"},{"cve":"CVE-2026-46644","cvss":4,"epss":0.0054,"slug":"cve-2026-46644-symfony-polyfill-improper-validation-of-punycode-labels-in-intl","title":"Symfony Polyfill improper validation of Punycode labels in Intl-Idn","severity":"medium","exploited":false,"published_at":"2026-07-14T21:16:55.85+00:00","url":"https://junglewise.ai/threats/cve-2026-46644-symfony-polyfill-improper-validation-of-punycode-labels-in-intl"},{"cve":"CVE-2026-48784","cvss":4,"epss":0.0035,"slug":"cve-2026-48784-symfony-routing-improper-dot-segment-encoding-in-urlgenerator","title":"Symfony Routing improper dot-segment encoding in UrlGenerator","severity":"medium","exploited":false,"published_at":"2026-07-14T20:17:10.517+00:00","url":"https://junglewise.ai/threats/cve-2026-48784-symfony-routing-improper-dot-segment-encoding-in-urlgenerator"},{"cve":"CVE-2026-48761","cvss":4,"epss":0.0035,"slug":"cve-2026-48761-symfony-htmlsanitizer-xss-via-incomplete-url-attribute","title":"Symfony HtmlSanitizer XSS via incomplete URL attribute sanitization","severity":"medium","exploited":false,"published_at":"2026-07-14T20:17:10.363+00:00","url":"https://junglewise.ai/threats/cve-2026-48761-symfony-htmlsanitizer-xss-via-incomplete-url-attribute"},{"cve":"CVE-2026-48760","cvss":0,"epss":0.0034,"slug":"cve-2026-48760-symfony-htmlsanitizer-visual-spoofing-via-percent-encoded-bidi","title":"Symfony HtmlSanitizer visual spoofing via percent-encoded BiDi characters","severity":"medium","exploited":false,"published_at":"2026-07-14T20:17:10.22+00:00","url":"https://junglewise.ai/threats/cve-2026-48760-symfony-htmlsanitizer-visual-spoofing-via-percent-encoded-bidi"},{"cve":"CVE-2026-48747","cvss":0,"epss":0.0025,"slug":"cve-2026-48747-symfony-mailomat-mailer-signature-algorithm-downgrade-in-webhook","title":"Symfony Mailomat Mailer signature algorithm downgrade in webhook parser","severity":"medium","exploited":false,"published_at":"2026-07-14T20:17:10.08+00:00","url":"https://junglewise.ai/threats/cve-2026-48747-symfony-mailomat-mailer-signature-algorithm-downgrade-in-webhook"},{"cve":"CVE-2026-48736","cvss":4,"epss":0.0057,"slug":"cve-2026-48736-symfony-ssrf-bypass-in-noprivatenetworkhttpclient-and-iputils","title":"Symfony SSRF bypass in NoPrivateNetworkHttpClient and IpUtils","severity":"medium","exploited":false,"published_at":"2026-07-14T20:17:09.943+00:00","url":"https://junglewise.ai/threats/cve-2026-48736-symfony-ssrf-bypass-in-noprivatenetworkhttpclient-and-iputils"},{"cve":"CVE-2026-48489","cvss":0,"epss":0.006,"slug":"cve-2026-48489-symfony-firewall-bypass-via-failure-forward-subrequest-in","title":"Symfony firewall bypass via failure_forward subrequest in security-http","severity":"high","exploited":false,"published_at":"2026-07-14T20:17:09.33+00:00","url":"https://junglewise.ai/threats/cve-2026-48489-symfony-firewall-bypass-via-failure-forward-subrequest-in"},{"cve":"CVE-2026-47212","cvss":4,"epss":0.0151,"slug":"cve-2026-47212-symfony-twilio-notifier-signature-verification-bypass-in","title":"Symfony Twilio Notifier signature verification bypass in TwilioRequestParser","severity":"medium","exploited":false,"published_at":"2026-07-14T20:17:01.187+00:00","url":"https://junglewise.ai/threats/cve-2026-47212-symfony-twilio-notifier-signature-verification-bypass-in"},{"cve":"CVE-2026-45071","cvss":4,"epss":0.0057,"slug":"cve-2026-45071-symfony-domcrawler-xxe-in-addxmlcontent","title":"Symfony DomCrawler XXE in addXmlContent","severity":"medium","exploited":false,"published_at":"2026-07-14T20:17:00.37+00:00","url":"https://junglewise.ai/threats/cve-2026-45071-symfony-domcrawler-xxe-in-addxmlcontent"},{"cve":"CVE-2026-45068","cvss":4,"epss":0.0052,"slug":"cve-2026-45068-symfony-mailer-argument-injection-in-sendmailtransport","title":"Symfony Mailer argument injection in SendmailTransport","severity":"medium","exploited":false,"published_at":"2026-07-14T20:17:00.107+00:00","url":"https://junglewise.ai/threats/cve-2026-45068-symfony-mailer-argument-injection-in-sendmailtransport"},{"cve":"CVE-2026-47767","cvss":4,"epss":0.0072,"slug":"cve-2026-47767-symfony-runtime-environment-variable-manipulation-via-query","title":"Symfony Runtime environment variable manipulation via query string bypass","severity":"medium","exploited":false,"published_at":"2026-07-14T19:17:09.237+00:00","url":"https://junglewise.ai/threats/cve-2026-47767-symfony-runtime-environment-variable-manipulation-via-query"},{"cve":"CVE-2026-45755","cvss":4,"epss":0.0027,"slug":"cve-2026-45755-symfony-mailtrap-mailer-bridge-signature-bypass-in","title":"Symfony Mailtrap mailer bridge signature bypass in MailtrapRequestParser","severity":"medium","exploited":false,"published_at":"2026-07-14T19:17:07.907+00:00","url":"https://junglewise.ai/threats/cve-2026-45755-symfony-mailtrap-mailer-bridge-signature-bypass-in"},{"cve":"CVE-2026-45754","cvss":4,"epss":0.0045,"slug":"cve-2026-45754-symfony-missing-webhook-secret-verification-in-mailjet-and-lox24","title":"Symfony missing webhook secret verification in Mailjet and LOX24 bridges","severity":"medium","exploited":false,"published_at":"2026-07-14T19:17:07.777+00:00","url":"https://junglewise.ai/threats/cve-2026-45754-symfony-missing-webhook-secret-verification-in-mailjet-and-lox24"},{"cve":"CVE-2026-45753","cvss":4,"epss":0.0034,"slug":"cve-2026-45753-symfony-htmlsanitizer-xss-via-incomplete-url-attribute-list","title":"Symfony HtmlSanitizer XSS via incomplete URL attribute list","severity":"medium","exploited":false,"published_at":"2026-07-14T19:17:07.633+00:00","url":"https://junglewise.ai/threats/cve-2026-45753-symfony-htmlsanitizer-xss-via-incomplete-url-attribute-list"},{"cve":"CVE-2026-45305","cvss":4,"epss":0.0068,"slug":"cve-2026-45305-symfony-yaml-redos-in-parser-cleanup","title":"Symfony Yaml ReDoS in Parser cleanup","severity":"medium","exploited":false,"published_at":"2026-07-14T19:17:07.187+00:00","url":"https://junglewise.ai/threats/cve-2026-45305-symfony-yaml-redos-in-parser-cleanup"},{"cve":"CVE-2026-45304","cvss":4,"epss":0.0068,"slug":"cve-2026-45304-symfony-yaml-denial-of-service-via-recursive-alias-expansion","title":"Symfony Yaml denial of service via recursive alias expansion","severity":"medium","exploited":false,"published_at":"2026-07-14T19:17:07.05+00:00","url":"https://junglewise.ai/threats/cve-2026-45304-symfony-yaml-denial-of-service-via-recursive-alias-expansion"},{"cve":"CVE-2026-45133","cvss":4,"epss":0.0063,"slug":"cve-2026-45133-symfony-yaml-uncontrolled-recursion-in-parser","title":"Symfony Yaml uncontrolled recursion in parser","severity":"medium","exploited":false,"published_at":"2026-07-14T19:17:06.913+00:00","url":"https://junglewise.ai/threats/cve-2026-45133-symfony-yaml-uncontrolled-recursion-in-parser"},{"cve":"CVE-2026-45075","cvss":4,"epss":0.0043,"slug":"cve-2026-45075-symfony-authorization-bypass-via-head-requests-in-security","title":"Symfony authorization bypass via HEAD requests in security attributes","severity":"medium","exploited":false,"published_at":"2026-07-14T19:17:06.65+00:00","url":"https://junglewise.ai/threats/cve-2026-45075-symfony-authorization-bypass-via-head-requests-in-security"}],"vendor":{"hub":true,"name":"Symfony","slug":"symfony","homepage":"https://symfony.com/","description":"A software project and organization focused on PHP development and the Symfony framework.","url":"https://junglewise.ai/threats/vendors/symfony"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":37},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-55878","cvss":7.8,"epss":0.0019,"slug":"cve-2026-55878-symfony-ux-toolkit-path-traversal-in-ux-install-command","title":"Symfony UX Toolkit path traversal in ux:install command","severity":"high","exploited":false,"published_at":"2026-07-08T22:17:16.05+00:00","url":"https://junglewise.ai/threats/cve-2026-55878-symfony-ux-toolkit-path-traversal-in-ux-install-command"},{"cve":"CVE-2026-45077","cvss":4,"epss":0.0067,"slug":"cve-2026-45077-symfony-monologbridge-php-deserialization-in-server-log-listener","title":"Symfony MonologBridge PHP deserialization in server:log listener","severity":"high","exploited":false,"published_at":"2026-07-14T18:17:17.13+00:00","url":"https://junglewise.ai/threats/cve-2026-45077-symfony-monologbridge-php-deserialization-in-server-log-listener"},{"cve":"CVE-2026-45067","cvss":4,"epss":0.006,"slug":"cve-2026-45067-symfony-mime-crlf-injection-in-address-constructor","title":"Symfony Mime CRLF injection in Address constructor","severity":"high","exploited":false,"published_at":"2026-07-14T18:17:16.847+00:00","url":"https://junglewise.ai/threats/cve-2026-45067-symfony-mime-crlf-injection-in-address-constructor"},{"cve":"CVE-2026-45063","cvss":4,"epss":0.0037,"slug":"cve-2026-45063-symfony-x509authenticator-authentication-bypass-via-spoofing","title":"Symfony X509Authenticator authentication bypass via spoofing","severity":"high","exploited":false,"published_at":"2026-07-14T19:17:05.62+00:00","url":"https://junglewise.ai/threats/cve-2026-45063-symfony-x509authenticator-authentication-bypass-via-spoofing"},{"cve":"CVE-2026-48489","cvss":0,"epss":0.006,"slug":"cve-2026-48489-symfony-firewall-bypass-via-failure-forward-subrequest-in","title":"Symfony firewall bypass via failure_forward subrequest in security-http","severity":"high","exploited":false,"published_at":"2026-07-14T20:17:09.33+00:00","url":"https://junglewise.ai/threats/cve-2026-48489-symfony-firewall-bypass-via-failure-forward-subrequest-in"},{"cve":"CVE-2026-45065","cvss":6.1,"epss":0.0035,"slug":"cve-2026-45065-symfony-open-redirect-in-urlgenerator-route-validation","title":"Symfony open redirect in UrlGenerator route validation","severity":"medium","exploited":false,"published_at":"2026-07-14T18:17:16.55+00:00","url":"https://junglewise.ai/threats/cve-2026-45065-symfony-open-redirect-in-urlgenerator-route-validation"},{"cve":"CVE-2026-55877","cvss":6.1,"epss":0.0034,"slug":"cve-2026-55877-symfony-ux-icons-cross-site-scripting-via-unsanitized-svg-content","title":"Symfony UX Icons cross-site scripting via unsanitized SVG content","severity":"medium","exploited":false,"published_at":"2026-07-08T22:17:15.92+00:00","url":"https://junglewise.ai/threats/cve-2026-55877-symfony-ux-icons-cross-site-scripting-via-unsanitized-svg-content"},{"cve":"CVE-2026-47212","cvss":4,"epss":0.0151,"slug":"cve-2026-47212-symfony-twilio-notifier-signature-verification-bypass-in","title":"Symfony Twilio Notifier signature verification bypass in TwilioRequestParser","severity":"medium","exploited":false,"published_at":"2026-07-14T20:17:01.187+00:00","url":"https://junglewise.ai/threats/cve-2026-47212-symfony-twilio-notifier-signature-verification-bypass-in"},{"cve":"CVE-2026-47767","cvss":4,"epss":0.0072,"slug":"cve-2026-47767-symfony-runtime-environment-variable-manipulation-via-query","title":"Symfony Runtime environment variable manipulation via query string bypass","severity":"medium","exploited":false,"published_at":"2026-07-14T19:17:09.237+00:00","url":"https://junglewise.ai/threats/cve-2026-47767-symfony-runtime-environment-variable-manipulation-via-query"},{"cve":"CVE-2026-45305","cvss":4,"epss":0.0068,"slug":"cve-2026-45305-symfony-yaml-redos-in-parser-cleanup","title":"Symfony Yaml ReDoS in Parser cleanup","severity":"medium","exploited":false,"published_at":"2026-07-14T19:17:07.187+00:00","url":"https://junglewise.ai/threats/cve-2026-45305-symfony-yaml-redos-in-parser-cleanup"}],"generated_at":"2026-09-26T20:07:00.238639+00:00","technologies":[{"name":"Symfony HtmlSanitizer","slug":"htmlsanitizer","vulnerabilities":6,"url":"https://junglewise.ai/threats/technologies/htmlsanitizer"},{"name":"Symfony Yaml Component","slug":"yaml","vulnerabilities":6,"url":"https://junglewise.ai/threats/technologies/yaml"},{"name":"Symfony Security HTTP","slug":"security-http","vulnerabilities":5,"url":"https://junglewise.ai/threats/technologies/security-http"},{"name":"Symfony UX Live Component","slug":"ux-live-component","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/ux-live-component"},{"name":"Symfony Mime","slug":"mime","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/mime"}]}