Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-48761Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> contentPackagist · symfony/html-sanitizer, symfony/symfony · fixed in 6.4.41, 7.4.13, 8.0.13
- CVE-2026-48747Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm DowngradePackagist · symfony/mailomat-mailer, symfony/symfony · fixed in 7.4.13, 8.0.13
- CVE-2026-48489Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET RoutesPackagist · symfony/security-http, symfony/symfony · fixed in 5.4.53, 6.4.41, 7.4.13 and more
- CVE-2026-48760Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing DefensePackagist · symfony/html-sanitizer, symfony/symfony · fixed in 6.4.41, 7.4.13, 8.0.13
- CVE-2026-48736Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClientPackagist · symfony/http-client, symfony/http-foundation +1 · fixed in 5.4.53, 6.4.41, 7.4.13 and more
- CVE-2026-48784Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 NormalizationPackagist · symfony/routing, symfony/symfony · fixed in 5.4.53, 6.4.41, 7.4.13 and more
- CVE-2026-45068Symfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient AddressPackagist · symfony/mailer, symfony/symfony · fixed in 5.4.52, 6.4.40, 7.4.12 and more
- CVE-2026-47212Symfony: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event InjectionPackagist · symfony/symfony, symfony/twilio-notifier · fixed in 6.4.40, 7.4.12, 8.0.12
- CVE-2026-45071Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = truePackagist · symfony/dom-crawler, symfony/symfony · fixed in 5.4.52, 6.4.40, 7.4.12 and more
- CVE-2026-45755Symfony: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event InjectionPackagist · symfony/mailtrap-mailer, symfony/symfony · fixed in 7.4.12, 8.0.12
- CVE-2026-45754Symfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event InjectionPackagist · symfony/lox24-notifier, symfony/mailjet-mailer +1 · fixed in 7.4.12, 8.0.12, 6.4.40
- CVE-2026-45305Symfony: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() RegexPackagist · symfony/symfony, symfony/yaml · fixed in 5.4.52, 6.4.40, 7.4.12 and more
- CVE-2026-45304Symfony: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")Packagist · symfony/symfony, symfony/yaml · fixed in 5.4.52, 6.4.40, 7.4.12 and more
- CVE-2026-45069Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp ClaimsPackagist · symfony/security-http, symfony/symfony · fixed in 6.4.40, 7.4.12, 8.0.12
- CVE-2026-47304.NET Security Feature Bypass VulnerabilityNuGet · system.security.cryptography.xml · fixed in 10.0.10, 9.0.18, 8.0.4
- CVE-2026-47303ASP.NET Core Elevation of Privilege VulnerabilityNuGet · microsoft.aspnetcore.authentication.negotiate · fixed in 10.0.10, 9.0.18, 8.0.29
- CVE-2026-47302.NET Denial of Service VulnerabilityNuGet · microsoft.netcore.app.runtime.linux-arm, microsoft.netcore.app.runtime.linux-arm64 +11 · fixed in 10.0.10, 9.0.18, 8.0.29 and more
- CVE-2026-45133Symfony: [Yaml] Harden the parser when handling untrusted inputPackagist · symfony/symfony, symfony/yaml · fixed in 5.4.52, 6.4.40, 7.4.12 and more
- CVE-2026-45075Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]Packagist · symfony/http-kernel, symfony/security-http +1 · fixed in 7.4.12, 8.0.12
- CVE-2026-47767Symfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv MismatchPackagist · symfony/runtime, symfony/symfony · fixed in 5.4.52, 6.4.40, 7.4.12 and more
- CVE-2026-45064Symfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href SpoofingPackagist · symfony/html-sanitizer, symfony/symfony · fixed in 6.4.40, 7.4.12, 8.0.12
- CVE-2026-45063Symfony: Identity Spoofing via Unanchored DN Regex in X509AuthenticatorPackagist · symfony/security-http, symfony/symfony · fixed in 5.4.52, 6.4.40, 7.4.12 and more
- CVE-2026-45070Symfony: Email Header Injection via Non-Token Characters in Mime Parameter NamesPackagist · symfony/mime, symfony/symfony · fixed in 5.4.52, 6.4.40, 7.4.12 and more
- CVE-2026-45073Symfony: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefixPackagist · symfony/cache, symfony/symfony · fixed in 5.4.52, 6.4.40, 7.4.12 and more
- CVE-2026-45753Symfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS)Packagist · symfony/html-sanitizer, symfony/symfony · fixed in 6.4.40, 7.4.12, 8.0.12
- CVE-2026-47300ASP.NET Core Elevation of Privilege VulnerabilityNuGet · microsoft.aspnetcore.authentication.negotiate · fixed in 10.0.10, 9.0.18, 8.0.29
- CVE-2026-45072Symfony: Stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File RenderingPackagist · symfony/symfony, symfony/twig-bridge +1 · fixed in 6.4.40, 7.4.12, 8.0.12
- CVE-2026-45756Symfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoSPackagist · symfony/json-path, symfony/symfony · fixed in 7.4.12, 8.0.12
- CVE-2026-45066Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> MisclassificationPackagist · symfony/html-sanitizer, symfony/symfony · fixed in 6.4.40, 7.4.12, 8.0.12
- CVE-2026-45074Symfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket ReplayPackagist · symfony/security-http, symfony/symfony · fixed in 7.4.12, 8.0.12