sensiolabs symfony vulnerabilities and fixes
Exploited and high-severity sensiolabs symfony vulnerabilities tracked by VulnFeed, with CVSS and EPSS scores, affected versions and fixes.
- 8.4CVE-2026-118515Symfony: The Serializer Builds UploadedFile Objects From Request Data, Letting a Client Point an Upload at Any Server FileFix availablesensiolabs symfony
2 min read - 8.2CVE-2026-121623Symfony: DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files, Letting a Client Read Any Server FileFix availablesensiolabs symfony
1 min read - 8.7CVE-2026-123792Symfony: Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document Hold a ProcessFix availablesensiolabs symfony
2 min read - 8.2CVE-2026-121971Symfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path ReferencesFix availablesensiolabs symfony
2 min read - 7.7CVE-2026-118513Symfony: X.509 Authentication Impersonation via DN Value Injection (incomplete fix for CVE-2026-45063)Fix availablesensiolabs symfony
2 min read