symfony ux
10 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-49215 | >= 3.0.0, < 3.1.0 ; >= 2.22.0, < 2.36.0 | Symfony UX: CSRF Protection Bypass in symfony/ux-live-component — Accept Header is CORS-Safelisted | LOW 2.1 | 0.2 % | ||
| CVE-2026-49216 | >= 3.0.0, < 3.1.0 ; < 2.36.0 | Symfony UX: XSS in symfony/ux-autocomplete via unescaped AJAX response data | MEDIUM 5.1 | 0.3 % | ||
| CVE-2026-49211 | >= 3.0.0, < 3.1.0 ; >= 2.2.0, < 2.36.0 | Symfony UX: Information exposure via unescaped LIKE wildcards in EntitySearchUtil | MEDIUM 6.9 | 0.5 % | ||
| CVE-2026-49208 | >= 3.0.0, < 3.1.0 ; >= 2.8.0, < 2.36.0 | Symfony UX: Format-less date LiveProps parsed with the permissive DateTime constructor | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-49210 | >= 3.0.0, < 3.1.0 ; >= 2.8.0, < 2.36.0 | Symfony UX: XSS in symfony/ux-live-component via attacker-controlled child component tag | LOW 2.3 | 0.3 % | ||
| CVE-2026-49212 | >= 3.0.0, < 3.1.0 ; < 2.36.0 | Symfony UX: LiveComponentHydrator HMAC checksum lacks component and slot binding | MEDIUM 6.9 | 0.2 % | ||
| CVE-2026-49209 | >= 3.0.0, < 3.1.0 ; >= 2.5.0, < 2.36.0 | Symfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requests | MEDIUM 5.3 | 0.6 % | ||
| CVE-2026-55877 | >= 2.17.0, < 2.36.1 ; >= 3.0.0, < 3.2.0 | Symfony UX: XSS in symfony/ux-icons via unsanitized SVG content in local files and Iconify on-demand responses | MEDIUM 6.1 | 0.3 % | ||
| CVE-2026-55878 | >= 2.32.0, < 2.36.1 ; >= 3.0.0, < 3.2.0 | Symfony: Path Traversal in symfony/ux-toolkit Allows Arbitrary File Write and Read via Crafted Recipe Manifest | HIGH 7.8 | 0.2 % | ||
| CVE-2025-47946 | < 2.25.1 | symfony/ux-live-component and symfony/ux-twig-component vulnerable to unsanitized HTML attribute injection via ComponentAttributes | MEDIUM 6.1 | 0.3 % |