Known Vulnerabilities for Symfony by Auth0
Listed below are 1 of the newest known vulnerabilities associated with "Symfony" by "Auth0".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-123824 json | The Symfony Config component XmlUtils::parse() enables DTD validation before rejecting documents that carry a doctype, allo... | Not Provided | 2026-11-06 | 2026-11-06 |
| CVE-2026-123792 json | The Symfony Yaml components Inline and Parser, parse some YAML documents inefficiently, so that a small crafted document c... | Not Provided | 2026-11-06 | 2026-11-06 |
| CVE-2026-123746 json | The Symfony Security HTTP component AuthenticatorManager::authenticateUser() does not run the firewall user checker’s chec... | Not Provided | 2026-11-06 | 2026-11-06 |
| CVE-2026-123339 json | Improper trust of forwarded headers in RouterListener::onKernelFinishRequest() in Symfony HttpKernel versions prior to 5.4.... | Not Provided | 2026-11-06 | 2026-11-06 |
| CVE-2026-123125 json | The Symfony Validator component IpValidator incompletely classifies internal addresses in the filtered modes of the Ip co... | Not Provided | 2026-11-05 | 2026-11-05 |
| CVE-2026-123119 json | The Symfony HttpClient component NoPrivateNetworkHttpClient does not pin the checked IP address of cached hosts, allowing f... | Not Provided | 2026-11-05 | 2026-11-05 |
| CVE-2026-122053 json | The Symfony Serializer component ObjectNormalizer treats any attribute name containing . (and, from Symfony 6.4, [) as a... | Not Provided | 2026-11-06 | 2026-11-06 |
| CVE-2026-121971 json | The component ScopingHttpClient in Symfony HttpClient merges the options of its default scope (such as auth_bearer or auth_... | Not Provided | 2026-11-04 | 2026-11-05 |
| CVE-2026-121949 json | The Symfony HtmlSanitizer component does not apply the media URL policy to the srcset and imagesrcset attributes, allowin... | Not Provided | 2026-11-05 | 2026-11-05 |
| CVE-2026-121623 json | The Symfony Serializer component DataUriNormalizer::denormalize() matches the data: scheme with a case-sensitive regular expr... | Not Provided | 2026-11-06 | 2026-11-06 |