prod
Ibexa OSS 4.6
110 vulnerabilities has been found
6 abandonned packages has been found
Last analyse : 2 hours ago
110
Vulnerabilities
25 affected packages
- Critical 3
- High 30
- Medium 33
- Low 10
- Unrated 3
-
Composer
78
-
Php
32
78
Composer
Vulnerabilities
- Critical 0
- High 17
- Medium 24
- Low 6
- Unrated 0
9
guzzlehttp/guzzle
6.5.8
-
High CVE-2026-69246 Reported 8/3/26Guzzle: Noncanonical host can bypass host-based checks
- Affected versions
>=8.0.0,<8.0.1|<7.15.2- Patched versions
7.15.28.0.1
-
Medium CVE-2026-55767 Reported 6/18/26Dot-only cookie domains match all hosts
- Affected versions
<7.12.1- Patched versions
7.12.1
https://github.com/guzzle/guzzle/security/advisories/GHSA-cwxw-98qj-8qjx
-
Medium Reported 7/20/26Guzzle: Unbounded response cookies risk denial of service
- Affected versions
<7.15.1- Patched versions
7.15.1
-
Medium CVE-2026-59883 Reported 7/20/26Guzzle: Cookie Disclosure and Injection via IP-Address Domains
- Affected versions
<7.12.3- Patched versions
7.12.3
-
Medium CVE-2026-69245 Reported 8/3/26Guzzle: Noncanonical cookie domain keeps subdomain scope
- Affected versions
>=8.0.0,<8.0.1|<7.15.2- Patched versions
7.15.28.0.1
-
Medium Reported 7/20/26Guzzle: URI fragments disclosed in redirect Referer headers
- Affected versions
<7.15.1- Patched versions
7.15.1
-
Medium CVE-2026-55568 Reported 6/18/26Silent HTTPS proxy downgrade to cleartext
- Affected versions
<7.12.1- Patched versions
7.12.1
https://github.com/guzzle/guzzle/security/advisories/GHSA-wpwq-4j6v-78m3
-
Medium Reported 7/20/26Guzzle: Proxy-Authorization headers can be sent to origin servers
- Affected versions
<7.14.2- Patched versions
7.14.2
-
Medium Reported 7/20/26Guzzle: Host-only cookie scope is not preserved
- Affected versions
<7.15.1- Patched versions
7.15.1
4
guzzlehttp/psr7
1.9.1
-
Medium CVE-2026-55766 Reported 6/18/26CRLF injection in HTTP start-line serialization
- Affected versions
<2.12.1- Patched versions
2.12.1
https://github.com/guzzle/psr7/security/advisories/GHSA-vm85-hxw5-5432
-
Medium CVE-2026-49214 Reported 6/11/26guzzlehttp/psr7 has CRLF Injection via URI Host Component
- Affected versions
<2.10.2- Patched versions
2.10.2
-
Medium CVE-2026-48998 Reported 6/11/26guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation
- Affected versions
<2.10.2- Patched versions
2.10.2
-
Medium CVE-2026-59882 Reported 7/21/26guzzlehttp/psr7: Host Confusion via Weak URI Host Validation
- Affected versions
<2.12.3- Patched versions
2.12.3
6
ibexa/admin-ui
v4.6.7
-
High IBEXA-SA-2024-006 Reported 11/28/24XSS in fields used in the Content name pattern
- Affected versions
v4.0.0,v4.0.8|v4.1.0,v4.1.5|v4.2.0,v4.2.4|v4.3.0,v4.3.5|v4.4.0,v4.4.4|v4.5.0,v4.5.7|v4.6.0,v4.6.13- Patched versions
v4.6.14
-
High IBEXA-SA-2025-003 Reported 6/11/25XSS vulnerabilities in back office
- Affected versions
v4.6.0,v4.6.20- Patched versions
v4.6.21
https://developers.ibexa.co/security-advisories/ibexa-sa-2025-003-xss-vulnerabilities-in-back-office
-
Medium Reported 6/13/25Ibexa Admin UI XSS vulnerabilities in back office
- Affected versions
>=4.6.0-beta1,<4.6.21- Patched versions
4.6.21
-
Medium Reported 10/17/25ibexa/admin-ui has an XSS vulnerability in Cancel/Reschedule future publication modal
- Affected versions
>=4.6.0,<4.6.25|>=5.0.0,<5.0.3- Patched versions
5.0.34.6.25
-
Medium CVE-2024-39318 Reported 7/31/24Ibexa Admin UI vulnerable to DOM-based Cross-site Scripting in file upload widget
- Affected versions
>=4.6.0-beta1,<4.6.9- Patched versions
4.6.9
-
Medium CVE-2024-53864 Reported 12/2/24Ibexa Admin UI vulnerable to Cross-site Scripting in a field that is used in the Content name pattern
- Affected versions
>=4.6.0,<4.6.14- Patched versions
4.6.14
2
ibexa/admin-ui-assets
v4.6.7
-
High IBEXA-SA-2025-003 Reported 6/11/25XSS vulnerabilities in back office
- Affected versions
v4.6.0,v4.6.20- Patched versions
v4.6.21
https://developers.ibexa.co/security-advisories/ibexa-sa-2025-003-xss-vulnerabilities-in-back-office
-
Medium Reported 6/13/25Ibexa Admin UI assets XSS vulnerabilities in back office
- Affected versions
>=4.6.0-alpha1,<4.6.21- Patched versions
4.6.21
6
ibexa/fieldtype-richtext
v4.6.7
-
High IBEXA-SA-2025-002 Reported 4/9/25XXE vulnerability in RichText
- Affected versions
v4.6.0,v4.6.18- Patched versions
v4.6.19
https://developers.ibexa.co/security-advisories/ibexa-sa-2025-002-xxe-vulnerability-in-richtext
-
High IBEXA-SA-2025-003 Reported 6/11/25XSS vulnerabilities in back office
- Affected versions
v4.6.0,v4.6.20- Patched versions
v4.6.21
https://developers.ibexa.co/security-advisories/ibexa-sa-2025-003-xss-vulnerabilities-in-back-office
-
High CVE-2024-43369 Reported 8/14/24Persistent Cross-site Scripting in Ibexa RichText Field Type
- Affected versions
>=4.6.0,<4.6.10- Patched versions
4.6.10
-
High Reported 4/10/25ibexa/fieldtype-richtext allows access to external entities in XML
- Affected versions
>=4.6.0-beta1,<4.6.19- Patched versions
4.6.19
-
Medium Reported 6/13/25Ibexa RichText Field Type XSS vulnerabilities in back office
- Affected versions
>=4.6.0-beta1,<4.6.21- Patched versions
4.6.21
-
Medium Reported 10/17/25ibexa/fieldtype-richtext has an XSS vulnerability via acronym custom tag in Rich Text
- Affected versions
>=4.6.0,<4.6.25|>=5.0.0,<5.0.3- Patched versions
5.0.34.6.25
2
ibexa/http-cache
v4.6.7
-
High IBEXA-SA-2024-006 Reported 11/28/24BREACH vulnerability in varnish VCL and vhost templates
- Affected versions
v4.0.0,v4.0.8|v4.1.0,v4.1.5|v4.2.0,v4.2.4|v4.3.0,v4.3.5|v4.4.0,v4.4.4|v4.5.0,v4.5.7|v4.6.0,v4.6.13- Patched versions
v4.6.14
-
Medium Reported 12/2/24ibexa/http-cache affected by Breach with Varnish VCL
- Affected versions
>=4.6.0,<4.6.14- Patched versions
4.6.14
2
ibexa/post-install
v4.6.7
-
High IBEXA-SA-2024-006 Reported 11/28/24BREACH vulnerability in varnish VCL and vhost templates
- Affected versions
v4.0.0,v4.0.8|v4.1.0,v4.1.5|v4.2.0,v4.2.4|v4.3.0,v4.3.5|v4.4.0,v4.4.4|v4.5.0,v4.5.7|v4.6.0,v4.6.13- Patched versions
v4.6.14
-
Medium Reported 12/2/24ibexa/post-install affected by Breach with Varnish VCL
- Affected versions
>=4.6.0,<4.6.14|>=1.0.0,<1.0.16- Patched versions
1.0.164.6.14
1
league/flysystem
2.5.0
-
Low CVE-2026-102601 Reported 9/29/26Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter
- Affected versions
<=3.35.2- Patched versions
3.35.3
1
symfony/cache
v5.4.40
-
Unrated CVE-2026-45073 Reported 5/20/26CVE-2026-45073: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
1
symfony/expression-language
v5.4.40
-
Unrated CVE-2026-109449 Reported 10/14/26CVE-2026-109449: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process
- Affected versions
>=2.4.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.54|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.48|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.21|>=8.0.0,<8.1.0|>=8.1.0,<8.1.9
2
symfony/http-client
v5.4.40
-
Unrated CVE-2026-48736 Reported 5/26/26CVE-2026-48736: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient
- Affected versions
>=5.4.0,<5.4.53
-
Low CVE-2024-50342 Reported 11/5/24CVE-2024-50342: Internal address and port enumeration allowed by NoPrivateNetworkHttpClient
- Affected versions
>=4.3.0,<4.4.0|>=4.4.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.46|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.14|>=7.0.0,<7.1.0|>=7.1.0,<7.1.7- Patched versions
5.4.466.4.147.1.75.4.466.4.147.1.7
3
symfony/http-foundation
v5.4.40
-
High CVE-2025-64500 Reported 11/12/25CVE-2025-64500: Incorrect parsing of PATH_INFO can lead to limited authorization bypass
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.50|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.29|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.3.7- Patched versions
5.4.506.4.297.3.75.4.506.4.297.3.7
-
Low CVE-2024-50345 Reported 11/5/24CVE-2024-50345: Open redirect via browser-sanitized URLs
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.46|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.14|>=7.0.0,<7.1.0|>=7.1.0,<7.1.7- Patched versions
5.4.466.4.147.1.75.4.466.4.147.1.7
-
Unrated CVE-2026-108082 Reported 9/15/26CVE-2026-108082: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header
- Affected versions
>=5.4.1,<5.4.54|>=6.0.1,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.46|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.19|>=8.0.0,<8.1.0|>=8.1.0,<8.1.7
2
symfony/mime
v5.4.40
-
Unrated CVE-2026-45067 Reported 5/20/26CVE-2026-45067: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
-
Unrated CVE-2026-45070 Reported 5/20/26CVE-2026-45070: Email Header Injection via Non-Token Characters in Mime Parameter Names
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
1
symfony/monolog-bridge
v5.4.40
-
Unrated CVE-2026-45077 Reported 5/20/26CVE-2026-45077: Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
1
symfony/polyfill-intl-idn
v1.30.0
-
Unrated CVE-2026-46644 Reported 5/26/26CVE-2026-46644: symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence
- Affected versions
>=1.17.1,<1.38.1
2
symfony/process
v5.4.40
-
High CVE-2024-51736 Reported 11/5/24CVE-2024-51736: Command execution hijack on Windows with Process class
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.46|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.14|>=7.0.0,<7.1.0|>=7.1.0,<7.1.7- Patched versions
5.4.466.4.147.1.75.4.466.4.147.1.7
-
Medium CVE-2026-24739 Reported 1/28/26Symfony's incorrect argument escaping under MSYS2/Git Bash can lead to destructive file operations on Windows
- Affected versions
>=8.0,<8.0.5|>=7.4,<7.4.5|>=7.3,<7.3.11|>=6.4,<6.4.33|<5.4.51- Patched versions
5.4.516.4.337.3.117.4.58.0.55.4.516.4.337.3.117.4.58.0.5
2
symfony/routing
v5.4.40
-
Unrated CVE-2026-48784 Reported 5/26/26CVE-2026-48784: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.53|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.41|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.13|>=8.0.0,<8.0.13
-
Unrated CVE-2026-45065 Reported 5/20/26CVE-2026-45065: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
1
symfony/runtime
v5.4.40
-
Medium CVE-2024-50340 Reported 11/5/24CVE-2024-50340: Ability to change environment from query
- Affected versions
>=5.3.0,<5.4.0|>=5.4.0,<5.4.46|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.14|>=7.0.0,<7.1.0|>=7.1.0,<7.1.7- Patched versions
5.4.466.4.147.1.75.4.466.4.147.1.7
3
symfony/security-http
v5.4.40
-
High CVE-2024-51996 Reported 11/13/24CVE-2024-51996: Authentication Bypass via persisted RememberMe cookie
- Affected versions
>=5.3.0,<5.4.0|>=5.4.0,<5.4.47|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.15|>=7.0.0,<7.1.0|>=7.1.0,<7.1.8- Patched versions
5.4.476.4.157.1.8
-
Unrated CVE-2026-48489 Reported 5/26/26CVE-2026-48489: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.53|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.41|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.13|>=8.0.0,<8.0.13
-
Unrated CVE-2026-45063 Reported 5/20/26CVE-2026-45063: Identity Spoofing via Unanchored DN Regex in X509Authenticator
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
1
symfony/validator
v5.4.40
-
Low CVE-2024-50343 Reported 8/30/24CVE-2024-50343: Incorrect response from Validator when input ends with ` `
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.43|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.11|>=7.0.0,<7.1.0|>=7.1.0,<7.1.4- Patched versions
5.4.436.4.117.1.45.4.436.4.117.1.4
4
symfony/yaml
v5.4.40
-
Unrated CVE-2026-45133 Reported 5/20/26CVE-2026-45133: YAML Parser Stack Exhaustion via Unbounded Recursion in Nested Blocks, Sequences, and Mappings
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
-
Unrated CVE-2026-45305 Reported 5/20/26CVE-2026-45305: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
-
Unrated CVE-2026-45304 Reported 5/20/26CVE-2026-45304: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
-
Unrated CVE-2026-109413 Reported 8/30/26CVE-2026-109413: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.54|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.45|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.18|>=8.0.0,<8.1.0|>=8.1.0,<8.1.6
1
twig/intl-extra
v3.10.0
-
Unrated CVE-2026-46629 Reported 5/20/26Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments
- Affected versions
>=2.12.0,<3.0.0|>=3.0.0,<3.26.0
18
twig/twig
v3.10.3
-
High CVE-2024-45411 Reported 9/9/24Twig has a possible sandbox bypass
- Affected versions
>=3.0.0,<3.14.0|>=2.0.0,<2.16.1|>=1.0.0,<1.44.8- Patched versions
1.44.82.16.13.14.0
-
High CVE-2026-49981 Reported 7/1/26Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`
- Affected versions
<=3.26.0- Patched versions
3.27.0
-
Unrated CVE-2026-48806 Reported 5/27/26Sandbox `__toString()` policy bypass via dynamic mapping keys
- Affected versions
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.27.0
https://symfony.com/blog/cve-2026-48806-sandbox-tostring-policy-bypass-via-dynamic-mapping-keys
-
Unrated CVE-2026-46634 Reported 5/20/26`template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name
- Affected versions
>=3.9.0,<3.26.0
-
Low CVE-2024-51755 Reported 11/6/24Unguarded calls to __isset() and to array-accesses when the sandbox is enabled
- Affected versions
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.11.2|>=3.12.0,<3.14.1- Patched versions
3.11.23.14.1
-
Unrated CVE-2026-46638 Reported 5/20/26`{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)
- Affected versions
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.26.0
-
Unrated CVE-2026-47732 Reported 5/20/26Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points
- Affected versions
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.26.0
-
Unrated CVE-2026-48808 Reported 5/27/26Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`
- Affected versions
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.27.0
-
Unrated CVE-2026-48805 Reported 5/27/26Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`
- Affected versions
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.27.0
-
Unrated CVE-2026-24425 Reported 5/20/26Possible sandbox bypass when using a source policy
- Affected versions
>=2.16.0,<3.0.0|>=3.9.0,<3.26.0
-
Unrated CVE-2026-46633 Reported 5/20/26PHP code injection via `{% use %}` template name
- Affected versions
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.26.0
-
Unrated CVE-2026-46627 Reported 5/20/26Sandbox does not protect against resource exhaustion
- Affected versions
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.26.0
-
Unrated CVE-2026-46635 Reported 5/20/26Sandbox property allowlist bypass via the `column` filter (array_column on objects)
- Affected versions
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.26.0
-
Unrated CVE-2026-46628 Reported 5/20/26The `spaceless` filter implicitly marks its output as safe
- Affected versions
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.26.0
-
Unrated CVE-2026-47730 Reported 5/20/26XSS in profiler HtmlDumper via unescaped template and profile names
- Affected versions
>=3.0.0,<3.26.0
-
Unrated CVE-2026-48807 Reported 5/27/26Sandbox `__toString()` policy bypass via `Traversable` in `join`/`replace` and `in`/`not in` operators
- Affected versions
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.27.0
-
Unrated CVE-2026-46636 Reported 5/27/26Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders
- Affected versions
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.27.0
-
Low CVE-2024-51754 Reported 11/6/24Unguarded calls to __toString() when nesting an object into an array
- Affected versions
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.11.2|>=3.12.0,<3.14.1- Patched versions
3.11.23.14.1
https://symfony.com/blog/unguarded-calls-to-__tostring-when-nesting-an-object-into-an-array
3
webonyx/graphql-php
v14.11.10
-
High Reported 5/4/26webonyx/graphql-php has quadratic validation cost in OverlappingFieldsCanBeMerged via inline fragments
- Affected versions
<15.32.2- Patched versions
15.32.2
-
High Reported 5/5/26webonyx/graphql-php has unbounded recursion in parser that causes stack overflow on crafted nested input
- Affected versions
<=15.32.2- Patched versions
15.32.3
-
Medium Reported 4/14/26graphql-php is affected by a Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validation
- Affected versions
<=15.31.4- Patched versions
15.31.5
32
Php
Vulnerabilities
- Critical 3
- High 13
- Medium 9
- Low 4
- Unrated 3
32
PHP
8.3.8
-
Critical CVE-2024-11236 Reported 11/24/24In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.
* [https://github.com/php/php-src/security/advisories/GHSA-5hqh-c84r-qjcv](https://github.com/php/php-src/security/advisories/GHSA-5hqh-c84r-qjcv)
-
Critical CVE-2025-1861 Reported 3/30/25In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.
* [https://github.com/php/php-src/security/advisories/GHSA-52jp-hrpf-2jff](https://github.com/php/php-src/security/advisories/GHSA-52jp-hrpf-2jff)
* [https://security.netapp.com/advisory/ntap-20250523-0005/](https://security.netapp.com/advisory/ntap-20250523-0005/) -
Critical CVE-2026-6722 Reported 5/10/26In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
* [https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5](https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5)
-
High CVE-2024-11233 Reported 11/24/24In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an error in convert.quoted-printable-decode filter certain data can lead to buffer overread by one byte, which can in certain circumstances lead to crashes or disclose content of other memory areas.
* [https://github.com/php/php-src/security/advisories/GHSA-r977-prxv-hc43](https://github.com/php/php-src/security/advisories/GHSA-r977-prxv-hc43)
-
High CVE-2024-11234 Reported 11/24/24In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.
* [https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2](https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2)
-
High CVE-2024-11235 Reported 4/4/25In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??= operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example by supplying specially crafted inputs to the script, it could lead to remote code execution.
- Affected versions
8.3.0|8.3.18,8.4.0|8.4.5
* [https://github.com/php/php-src/security/advisories/GHSA-rwp7-7vc6-8477](https://github.com/php/php-src/security/advisories/GHSA-rwp7-7vc6-8477)
* [https://github.com/php/php-src/security/advisories/GHSA-rwp7-7vc6-8477](https://github.com/php/php-src/security/advisories/GHSA-rwp7-7vc6-8477) -
High CVE-2024-8926 Reported 10/8/24In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3 may still be bypassed and the same command injection related to Windows "Best Fit" codepage behavior can be achieved. This may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
* [https://github.com/php/php-src/security/advisories/GHSA-p99j-rfp4-xqvq](https://github.com/php/php-src/security/advisories/GHSA-p99j-rfp4-xqvq)
-
High CVE-2024-8927 Reported 10/8/24In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP.
* [https://github.com/php/php-src/security/advisories/GHSA-94p6-54jq-9mwp](https://github.com/php/php-src/security/advisories/GHSA-94p6-54jq-9mwp)
-
High CVE-2025-14177 Reported 12/27/25In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.
* [https://github.com/php/php-src/security/advisories/GHSA-3237-qqm7-mfv7](https://github.com/php/php-src/security/advisories/GHSA-3237-qqm7-mfv7)
-
High CVE-2025-14178 Reported 12/27/25In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.
* [https://github.com/php/php-src/security/advisories/GHSA-h96m-rvf9-jgm2](https://github.com/php/php-src/security/advisories/GHSA-h96m-rvf9-jgm2)
-
High CVE-2025-14179 Reported 5/10/26In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
* [https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm](https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm)
-
High CVE-2025-14180 Reported 12/27/25In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.
* [https://github.com/php/php-src/security/advisories/GHSA-8xr5-qppj-gvwj](https://github.com/php/php-src/security/advisories/GHSA-8xr5-qppj-gvwj)
-
High CVE-2025-1735 Reported 7/13/25In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.
* [https://github.com/php/php-src/security/advisories/GHSA-hrwm-9436-5mv3](https://github.com/php/php-src/security/advisories/GHSA-hrwm-9436-5mv3)
-
High CVE-2025-1736 Reported 3/30/25In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line characters may prevent certain headers from being sent or lead to certain headers be misinterpreted.
* [https://github.com/php/php-src/security/advisories/GHSA-hgf5-96fm-v528](https://github.com/php/php-src/security/advisories/GHSA-hgf5-96fm-v528)
* [https://security.netapp.com/advisory/ntap-20250523-0006/](https://security.netapp.com/advisory/ntap-20250523-0006/) -
High CVE-2026-17543 Reported 7/30/26Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.
* [https://github.com/php/php-src/security/advisories/GHSA-7qpv-r5mr-78m4](https://github.com/php/php-src/security/advisories/GHSA-7qpv-r5mr-78m4)
-
High CVE-2026-6735 Reported 5/10/26In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.
* [https://github.com/php/php-src/security/advisories/GHSA-7qg2-v9fj-4mwv](https://github.com/php/php-src/security/advisories/GHSA-7qg2-v9fj-4mwv)
-
Medium CVE-2024-8925 Reported 10/8/24In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.
* [https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32](https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32)
-
Medium CVE-2025-1219 Reported 3/30/25In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect. This may cause the resulting document to be parsed incorrectly or bypass validations.
- Affected versions
8.1.0|8.1.31,8.2.0|8.2.27,8.3.0|8.3.18,8.4.0|8.4.4
* [https://github.com/php/php-src/security/advisories/GHSA-p3x9-6h7p-cgfc](https://github.com/php/php-src/security/advisories/GHSA-p3x9-6h7p-cgfc)
* [https://github.com/php/php-src/security/advisories/GHSA-p3x9-6h7p-cgfc](https://github.com/php/php-src/security/advisories/GHSA-p3x9-6h7p-cgfc) -
Medium CVE-2025-1220 Reported 7/13/25In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() treat the hostname in different way, thus opening way to security problems if the user code implements access checks before access using such functions.
* [https://github.com/php/php-src/security/advisories/GHSA-3cr5-j632-f35r](https://github.com/php/php-src/security/advisories/GHSA-3cr5-j632-f35r)
* [https://github.com/php/php-src/security/advisories/GHSA-3cr5-j632-f35r](https://github.com/php/php-src/security/advisories/GHSA-3cr5-j632-f35r) -
Medium CVE-2025-1734 Reported 3/30/25In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers.
* [https://github.com/php/php-src/security/advisories/GHSA-pcmh-g36c-qc44](https://github.com/php/php-src/security/advisories/GHSA-pcmh-g36c-qc44)
* [https://security.netapp.com/advisory/ntap-20250523-0009/](https://security.netapp.com/advisory/ntap-20250523-0009/) -
Medium CVE-2026-14355 Reported 7/3/26In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.
* [https://github.com/php/php-src/security/advisories/GHSA-7jrw-539f-x6vr](https://github.com/php/php-src/security/advisories/GHSA-7jrw-539f-x6vr)
* [https://lists.debian.org/debian-lts-announce/2026/07/msg00010.html](https://lists.debian.org/debian-lts-announce/2026/07/msg00010.html) -
Medium CVE-2026-7258 Reported 5/10/26In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass signed char to ctype functions (like isxdigit()). On the systems with default signed char and optimized table-lookup ctype functions - such as NetBSD - this can lead to accessing array with negative offset, which can trigger a denial of service.
* [https://github.com/php/php-src/security/advisories/GHSA-m8rr-4c36-8gq4](https://github.com/php/php-src/security/advisories/GHSA-m8rr-4c36-8gq4)
-
Medium CVE-2026-7260 Reported 7/30/26Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.
* [https://github.com/php/php-src/security/advisories/GHSA-vc5h-9ppw-p5f3](https://github.com/php/php-src/security/advisories/GHSA-vc5h-9ppw-p5f3)
-
Medium CVE-2026-7261 Reported 5/10/26In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistance is handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-after-free. This may lead to memory corruption, information disclosure, or process crashes, with confidentiality, integrity, and availability impact on the vulnerable system.
* [https://github.com/php/php-src/security/advisories/GHSA-m33r-qmcv-p97q](https://github.com/php/php-src/security/advisories/GHSA-m33r-qmcv-p97q)
-
Medium CVE-2026-7568 Reported 5/10/26In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metaphone.c uses a signed int variable to track the current position within the input string. If a string longer than 2,147,483,647 bytes is passed, a signed integer overflow occurs, resulting in undefined behavior. This can lead to an out-of-bounds read, causing a segmentation fault or access to unrelated memory, and may affect the availability of the PHP process.
* [https://github.com/php/php-src/security/advisories/GHSA-96wq-48vp-hh57](https://github.com/php/php-src/security/advisories/GHSA-96wq-48vp-hh57)
-
Low CVE-2024-9026 Reported 10/8/24In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.
* [https://github.com/php/php-src/security/advisories/GHSA-865w-9rf3-2wh5](https://github.com/php/php-src/security/advisories/GHSA-865w-9rf3-2wh5)
-
Low CVE-2025-1217 Reported 3/29/25In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when http request module parses HTTP response obtained from a server, folded headers are parsed incorrectly, which may lead to misinterpreting the response and using incorrect headers, MIME types, etc.
- Affected versions
8.1.0|8.1.31,8.2.0|8.2.27,8.3.0|8.3.18,8.4.0|8.4.4
* [https://github.com/php/php-src/security/advisories/GHSA-v8xr-gpvj-cx9g](https://github.com/php/php-src/security/advisories/GHSA-v8xr-gpvj-cx9g)
* [https://github.com/php/php-src/security/advisories/GHSA-v8xr-gpvj-cx9g](https://github.com/php/php-src/security/advisories/GHSA-v8xr-gpvj-cx9g) -
Low CVE-2026-7259 Reported 5/10/26In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to mb_regex_encoding().
* [https://github.com/php/php-src/security/advisories/GHSA-wm6j-2649-pv75](https://github.com/php/php-src/security/advisories/GHSA-wm6j-2649-pv75)
-
Low CVE-2026-7262 Reported 5/10/26In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of missing value element. This leads to dereferences a NULL pointer, causing a segmentation fault. This allows a remote unauthenticated attacker to crash the PHP SOAP server process, resulting in denial of service.
* [https://github.com/php/php-src/security/advisories/GHSA-hmxp-6pc4-f3vv](https://github.com/php/php-src/security/advisories/GHSA-hmxp-6pc4-f3vv)
-
Unrated CVE-2024-8929 Reported 11/22/24In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different users of the same server.
* [https://github.com/php/php-src/security/advisories/GHSA-h35g-vwh6-m678](https://github.com/php/php-src/security/advisories/GHSA-h35g-vwh6-m678)
* [https://security.netapp.com/advisory/ntap-20250110-0008/](https://security.netapp.com/advisory/ntap-20250110-0008/) -
Unrated CVE-2024-8932 Reported 11/22/24In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.
* [https://github.com/php/php-src/security/advisories/GHSA-g665-fm4p-vhff](https://github.com/php/php-src/security/advisories/GHSA-g665-fm4p-vhff)
* [https://security.netapp.com/advisory/ntap-20250110-0009/](https://security.netapp.com/advisory/ntap-20250110-0009/) -
Unrated CVE-2025-6491 Reported 7/13/25In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server.
* [https://github.com/php/php-src/security/advisories/GHSA-453j-q27h-5p8x](https://github.com/php/php-src/security/advisories/GHSA-453j-q27h-5p8x)
* [https://github.com/php/php-src/security/advisories/GHSA-453j-q27h-5p8x](https://github.com/php/php-src/security/advisories/GHSA-453j-q27h-5p8x)
6
Abandonned packages
to replace or keep an eye on
- sensio/framework-extra-bundle Symfony
- php-http/message-factory psr/http-factory
- platformsh/symfonyflex-bridge None
- swiftmailer/swiftmailer symfony/mailer
- symfony/swiftmailer-bundle symfony/mailer
- php-http/guzzle6-adapter guzzlehttp/guzzle or php-http/guzzle7-adapter
Your version is Ibexa 4.6
Maintained version
Your version is Symfony 5.4
Security fixes only
Your version is Php 7.4
End of life
Current vulnerabilities
110
Last change
+3
Oct 16, 2026
Abandoned packages
6
Analyses with changes
64
Vulnerabilities by severity
Changes between analyses
Latest changes
-
Oct 16, 2026, 3:04 AM+3 new110 total
-
Oct 1, 2026, 4:09 PM+32 new107 total
-
Sep 30, 2026, 3:04 AM+1 new75 total
-
Sep 24, 2026, 3:03 AM−34 closed74 total
-
Aug 7, 2026, 3:03 AM+2 new108 total
-
Aug 4, 2026, 3:03 AM+2 new106 total
-
Jul 22, 2026, 3:03 AM+1 new104 total
-
Jul 21, 2026, 3:03 AM+5 new103 total
-
Jul 10, 2026, 3:02 AM+1 new98 total
-
Jul 8, 2026, 3:02 AM+66 new +6 abandoned97 total
-
Jul 7, 2026, 3:02 AM−35 closed −6 abandoned31 total
-
Jul 2, 2026, 3:06 AM+1 new66 total
-
Jul 1, 2026, 3:06 AM−31 closed65 total
-
Jun 20, 2026, 3:02 AM+3 new96 total
-
Jun 13, 2026, 3:03 AM+2 new93 total
-
May 28, 2026, 3:03 AM+8 new91 total
-
May 27, 2026, 3:03 AM+1 new83 total
-
May 21, 2026, 3:03 AM+19 new82 total
-
May 14, 2026, 3:03 AM+8 new63 total
-
May 6, 2026, 3:03 AM+1 new55 total
-
May 5, 2026, 3:03 AM+1 new54 total
-
May 1, 2026, 3:03 AM+30 new +6 abandoned53 total
-
Apr 30, 2026, 3:02 AM−30 closed −6 abandoned23 total
-
Apr 15, 2026, 3:03 AM+1 new53 total
-
Jan 29, 2026, 2:04 AM+1 new52 total
-
Jan 11, 2026, 2:04 AM+2 new51 total
-
Jan 10, 2026, 2:04 AM+1 new49 total
-
Dec 10, 2025, 2:04 AM+20 new48 total
-
Dec 9, 2025, 2:04 AM−20 closed28 total
-
Nov 13, 2025, 2:04 AM+1 new48 total
-
Oct 18, 2025, 3:04 AM+2 new47 total
-
Oct 8, 2025, 3:04 AM−1 closed45 total
-
Aug 21, 2025, 3:03 AM+4 new46 total
-
Aug 5, 2025, 3:04 AM+16 new42 total
-
Jul 31, 2025, 3:06 AM−16 closed26 total
-
Jul 24, 2025, 3:04 AM+3 new42 total
-
Jul 7, 2025, 3:04 AM+5 new39 total
-
Jun 19, 2025, 3:02 AM+1 new34 total
-
Jun 14, 2025, 3:02 AM+3 new33 total
-
Jun 13, 2025, 3:02 AM+3 new30 total
-
May 3, 2025, 3:02 AM+1 new27 total
-
May 2, 2025, 3:02 AM+1 new26 total
-
Apr 17, 2025, 3:02 AM+1 new25 total
-
Apr 11, 2025, 3:02 AM+1 new24 total
-
Apr 10, 2025, 3:02 AM+1 new23 total
-
Feb 28, 2025, 2:02 AM+22 new +6 abandoned22 total
-
Feb 21, 2025, 3:39 AM−22 closed −6 abandoned0 total
-
Dec 4, 2024, 2:02 AM−1 closed22 total
-
Dec 3, 2024, 2:02 AM+5 new23 total
-
Nov 30, 2024, 2:02 AM+3 new18 total
-
Nov 28, 2024, 2:02 AM+3 new15 total
-
Nov 26, 2024, 2:02 AM+11 new +6 abandoned12 total
-
Nov 25, 2024, 2:02 AM−11 closed −6 abandoned1 total
-
Nov 14, 2024, 2:02 AM+1 new12 total
-
Nov 9, 2024, 2:02 AM+1 new11 total
-
Nov 7, 2024, 2:28 AM+7 new10 total
-
Nov 6, 2024, 2:28 AM+3 new +6 abandoned3 total
-
Nov 5, 2024, 2:39 AM−3 closed −6 abandoned0 total
-
Sep 10, 2024, 3:28 AM+1 new3 total
-
Aug 15, 2024, 3:28 AM+1 new2 total
-
Aug 1, 2024, 3:28 AM+1 new1 total
-
Jul 24, 2024, 3:30 AM−1 closed0 total
-
Jul 12, 2024, 8:53 AM+1 new1 total
-
Jun 3, 2024, 5:14 PM−1 closed0 total
Badges
[](https://audit.security.code-rhapsodie.fr/en/project/018fdea7-1ba2-7bdf-abab-51452e155926)
[](https://audit.security.code-rhapsodie.fr/en/project/018fdea7-1ba2-7bdf-abab-51452e155926)
[](https://audit.security.code-rhapsodie.fr/en/project/018fdea7-1ba2-7bdf-abab-51452e155926)
[](https://audit.security.code-rhapsodie.fr/en/project/018fdea7-1ba2-7bdf-abab-51452e155926)