What’s Vulnerable › Products

symfony ux vulnerabilities

10 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 10 published in the last 12 months.

Check whether your symfony ux version is affected

Latest symfony ux vulnerabilities

• CVE-2026-49216 — Symfony UX: XSS in symfony/ux-autocomplete via unescaped AJAX response data (CVSS 5.4)
• CVE-2026-49215 — Symfony UX: CSRF Protection Bypass in symfony/ux-live-component — Accept Header is CORS-Safelisted (CVSS 5.4)
• CVE-2026-49212 — Symfony UX: LiveComponentHydrator HMAC checksum lacks component and slot binding (CVSS 7.5)
• CVE-2026-49211 — Symfony UX: Information exposure via unescaped LIKE wildcards in EntitySearchUtil (CVSS 7.5)
• CVE-2026-49210 — Symfony UX: XSS in symfony/ux-live-component via attacker-controlled child component tag (CVSS 6.1)
• CVE-2026-49209 — Symfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requests (CVSS 6.5)
• CVE-2026-49208 — Symfony UX: Format-less date LiveProps parsed with the permissive DateTime constructor (CVSS 5.3)
• CVE-2026-55878 — Symfony: Path Traversal in symfony/ux-toolkit Allows Arbitrary File Write and Read via Crafted Recipe Manifest (CVSS 7.8)
• CVE-2026-55877 — Symfony UX: XSS in symfony/ux-icons via unsanitized SVG content in local files and Iconify on-demand responses (CVSS 6.1)
• CVE-2025-47946 — symfony/ux-live-component and symfony/ux-twig-component vulnerable to unsanitized HTML attribute injection via ComponentAttributes (CVSS 6.1)