prod
Drupal 11
68 vulnerabilities has been found
0 abandonned packages has been found
Last analyse : 2 hours ago
68
Vulnerabilities
13 affected packages
- Critical 1
- High 7
- Medium 22
- Low 12
- Unrated 0
-
Composer
68
68
Composer
Vulnerabilities
- Critical 1
- High 7
- Medium 22
- Low 12
- Unrated 0
16
drupal/core
11.0.1
-
Critical CVE-2026-9082 Reported 5/20/26Drupal Core has a SQL Injection issue
- Affected versions
>=11.3.0,<11.3.10|>=11.2.0,<11.2.12|>=11.0.0,<11.1.10|>=10.6.0,<10.6.9|>=10.5.0,<10.5.10|>=8.9.0,<10.4.10- Patched versions
10.4.1010.5.1010.6.911.1.1011.2.1211.3.10
-
High CVE-2024-55637 Reported 12/10/24Drupal core contains a potential PHP Object Injection vulnerability
- Affected versions
>=11.0.0,<11.0.8|>=10.3.0,<10.3.9|>=8.8.0,<10.2.11- Patched versions
10.2.1110.3.911.0.810.2.1110.3.911.0.810.2.1110.3.911.0.8
-
Medium CVE-2026-6365 Reported 5/20/26Drupal core is Vulnerable to Cross-Site Scripting
- Affected versions
>=11.3.0,<11.3.7|>=11.0.0,<11.2.11|>=10.6.0,<10.6.7|>=8.0.0,<10.5.9- Patched versions
10.5.910.6.711.2.1111.3.7
-
Medium CVE-2025-31674 Reported 4/1/25Drupal Core Improperly Controlled Modification of Dynamically-Determined Object Attributes Vulnerability
- Affected versions
>=11.1.0,<11.1.3|>=11.0.0,<11.0.12|>=10.4.0,<10.4.3|>=8.0.0,<10.3.13- Patched versions
10.3.1310.4.311.0.1211.1.3
-
Medium CVE-2026-6366 Reported 5/20/26Drupal core allows Object Injection
- Affected versions
>=11.3.0,<11.3.7|>=11.0.0,<11.2.11|>=10.6.0,<10.6.7|>=8.0.0,<10.5.9- Patched versions
10.5.910.6.711.2.1111.3.7
-
Medium CVE-2025-3057 Reported 4/1/25Drupal Core Potential Cross-Site Scripting (XSS) via Error Messages
- Affected versions
>=11.1.0,<11.1.3|>=11.0.0,<11.0.12|>=10.4.0,<10.4.3|>=8.0.0,<10.3.13- Patched versions
10.3.1310.4.311.0.1211.1.3
-
Medium CVE-2025-31673 Reported 4/1/25Drupal Core Vulnerable to Forceful Browsing
- Affected versions
>=11.1.0,<11.1.3|>=11.0.0,<11.0.12|>=10.4.0,<10.4.3|>=8.0.0,<10.3.13- Patched versions
10.3.1310.4.311.0.1211.1.3
-
Medium CVE-2024-55634 Reported 12/10/24Drupal core Access bypass
- Affected versions
>=11.0.0,<11.0.8|>=10.3.0,<10.3.9|>=8.0.0,<10.2.11- Patched versions
10.2.1110.3.911.0.810.2.1110.3.911.0.810.2.1110.3.911.0.8
-
Medium CVE-2025-13081 Reported 11/18/25Drupal core allows Object Injection
- Affected versions
>=11.2.0,<11.2.8|>=11.0.0,<11.1.9|>=10.5.0,<10.5.6|>=8.0.0,<10.4.9- Patched versions
10.4.910.5.611.1.911.2.8
-
Medium CVE-2024-12393 Reported 12/10/24Drupal Core Cross-Site Scripting (XSS)
- Affected versions
>=11.0.0,<11.0.8|>=10.3.0,<10.3.9|>=8.8.0,<10.2.11- Patched versions
10.2.1110.3.911.0.810.2.1110.3.911.0.810.2.1110.3.911.0.8
-
Low CVE-2025-31675 Reported 4/1/25Drupal Core Cross-Site Scripting (XSS) Vulnerability
- Affected versions
>=11.1.0,<11.1.5|>=11.0.0,<11.0.13|>=10.4.0,<10.4.5|>=8.0.0,<10.3.14- Patched versions
10.3.1410.4.511.0.1311.1.5
-
Low CVE-2025-13080 Reported 11/18/25Drupal core allows Forceful Browsing
- Affected versions
>=11.2.0,<11.2.8|>=11.0.0,<11.1.9|>=10.5.0,<10.5.6|>=8.0.0,<10.4.9- Patched versions
10.4.910.5.611.1.911.2.8
-
Low CVE-2025-13083 Reported 11/18/25Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels
- Affected versions
>=11.2.0,<11.2.8|>=11.0.0,<11.1.9|>=10.5.0,<10.5.6|>=8.0.0,<10.4.9- Patched versions
10.4.910.5.611.1.911.2.8
-
Low CVE-2025-13082 Reported 11/18/25Drupal core allows Content Spoofing
- Affected versions
>=11.2.0,<11.2.8|>=11.0.0,<11.1.9|>=10.5.0,<10.5.6|>=8.0.0,<10.4.9- Patched versions
10.4.910.5.611.1.911.2.8
-
Low CVE-2024-55636 Reported 12/10/24Drupal core contains a potential PHP Object Injection vulnerability
- Affected versions
>=11.0.0,<11.0.8|>=10.3.0,<10.3.9|>=8.8.0,<10.2.11- Patched versions
10.2.1110.3.911.0.810.2.1110.3.911.0.810.2.1110.3.911.0.8
-
Low CVE-2024-45440 Reported 8/29/24Drupal Full Path Disclosure
- Affected versions
>=8.0.0,<=11.0.4- Patched versions
5
drupal/core-recommended
11.0.1
-
High CVE-2024-55637 Reported 12/10/24Drupal core contains a potential PHP Object Injection vulnerability
- Affected versions
>=11.0.0,<11.0.8|>=10.3.0,<10.3.9|>=8.8.0,<10.2.11- Patched versions
10.2.1110.3.911.0.810.2.1110.3.911.0.810.2.1110.3.911.0.8
-
Medium CVE-2024-12393 Reported 12/10/24Drupal Core Cross-Site Scripting (XSS)
- Affected versions
>=11.0.0,<11.0.8|>=10.3.0,<10.3.9|>=8.8.0,<10.2.11- Patched versions
10.2.1110.3.911.0.810.2.1110.3.911.0.810.2.1110.3.911.0.8
-
Medium CVE-2024-55634 Reported 12/10/24Drupal core Access bypass
- Affected versions
>=11.0.0,<11.0.8|>=10.3.0,<10.3.9|>=8.0.0,<10.2.11- Patched versions
10.2.1110.3.911.0.810.2.1110.3.911.0.810.2.1110.3.911.0.8
-
Low CVE-2024-45440 Reported 8/29/24Drupal Full Path Disclosure
- Affected versions
>=8.0.0,<=11.0.4- Patched versions
-
Low CVE-2024-55636 Reported 12/10/24Drupal core contains a potential PHP Object Injection vulnerability
- Affected versions
>=11.0.0,<11.0.8|>=10.3.0,<10.3.9|>=8.8.0,<10.2.11- Patched versions
10.2.1110.3.911.0.810.2.1110.3.911.0.810.2.1110.3.911.0.8
9
guzzlehttp/guzzle
7.9.2
-
High CVE-2026-69246 Reported 8/3/26Guzzle: Noncanonical host can bypass host-based checks
- Affected versions
>=8.0.0,<8.0.1|<7.15.2- Patched versions
7.15.28.0.1
-
Medium CVE-2026-55767 Reported 6/18/26Dot-only cookie domains match all hosts
- Affected versions
<7.12.1- Patched versions
7.12.1
https://github.com/guzzle/guzzle/security/advisories/GHSA-cwxw-98qj-8qjx
-
Medium Reported 7/20/26Guzzle: Unbounded response cookies risk denial of service
- Affected versions
<7.15.1- Patched versions
7.15.1
-
Medium CVE-2026-59883 Reported 7/20/26Guzzle: Cookie Disclosure and Injection via IP-Address Domains
- Affected versions
<7.12.3- Patched versions
7.12.3
-
Medium CVE-2026-69245 Reported 8/3/26Guzzle: Noncanonical cookie domain keeps subdomain scope
- Affected versions
>=8.0.0,<8.0.1|<7.15.2- Patched versions
7.15.28.0.1
-
Medium Reported 7/20/26Guzzle: URI fragments disclosed in redirect Referer headers
- Affected versions
<7.15.1- Patched versions
7.15.1
-
Medium CVE-2026-55568 Reported 6/18/26Silent HTTPS proxy downgrade to cleartext
- Affected versions
<7.12.1- Patched versions
7.12.1
https://github.com/guzzle/guzzle/security/advisories/GHSA-wpwq-4j6v-78m3
-
Medium Reported 7/20/26Guzzle: Proxy-Authorization headers can be sent to origin servers
- Affected versions
<7.14.2- Patched versions
7.14.2
-
Medium Reported 7/20/26Guzzle: Host-only cookie scope is not preserved
- Affected versions
<7.15.1- Patched versions
7.15.1
4
guzzlehttp/psr7
2.7.0
-
Medium CVE-2026-55766 Reported 6/18/26CRLF injection in HTTP start-line serialization
- Affected versions
<2.12.1- Patched versions
2.12.1
https://github.com/guzzle/psr7/security/advisories/GHSA-vm85-hxw5-5432
-
Medium CVE-2026-49214 Reported 6/11/26guzzlehttp/psr7 has CRLF Injection via URI Host Component
- Affected versions
<2.10.2- Patched versions
2.10.2
-
Medium CVE-2026-48998 Reported 6/11/26guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation
- Affected versions
<2.10.2- Patched versions
2.10.2
-
Medium CVE-2026-59882 Reported 7/21/26guzzlehttp/psr7: Host Confusion via Weak URI Host Validation
- Affected versions
<2.12.3- Patched versions
2.12.3
4
symfony/http-foundation
v7.1.3
-
High CVE-2025-64500 Reported 11/12/25CVE-2025-64500: Incorrect parsing of PATH_INFO can lead to limited authorization bypass
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.50|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.29|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.3.7- Patched versions
5.4.506.4.297.3.75.4.506.4.297.3.7
-
Low CVE-2024-50345 Reported 11/5/24CVE-2024-50345: Open redirect via browser-sanitized URLs
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.46|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.14|>=7.0.0,<7.1.0|>=7.1.0,<7.1.7- Patched versions
5.4.466.4.147.1.75.4.466.4.147.1.7
-
Unrated CVE-2026-108082 Reported 9/15/26CVE-2026-108082: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header
- Affected versions
>=5.4.1,<5.4.54|>=6.0.1,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.46|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.19|>=8.0.0,<8.1.0|>=8.1.0,<8.1.7
-
Unrated CVE-2026-48736 Reported 5/26/26CVE-2026-48736: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient
- Affected versions
>=6.4.0,<6.4.41|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.13|>=8.0.0,<8.0.13
1
symfony/mailer
v7.1.2
-
Unrated CVE-2026-45068 Reported 5/20/26CVE-2026-45068: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
2
symfony/mime
v7.1.2
-
Unrated CVE-2026-45067 Reported 5/20/26CVE-2026-45067: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
-
Unrated CVE-2026-45070 Reported 5/20/26CVE-2026-45070: Email Header Injection via Non-Token Characters in Mime Parameter Names
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
1
symfony/polyfill-intl-idn
v1.30.0
-
Unrated CVE-2026-46644 Reported 5/26/26CVE-2026-46644: symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence
- Affected versions
>=1.17.1,<1.38.1
1
symfony/process
v7.1.3
-
High CVE-2024-51736 Reported 11/5/24CVE-2024-51736: Command execution hijack on Windows with Process class
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.46|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.14|>=7.0.0,<7.1.0|>=7.1.0,<7.1.7- Patched versions
5.4.466.4.147.1.75.4.466.4.147.1.7
2
symfony/routing
v7.1.3
-
Unrated CVE-2026-48784 Reported 5/26/26CVE-2026-48784: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.53|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.41|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.13|>=8.0.0,<8.0.13
-
Unrated CVE-2026-45065 Reported 5/20/26CVE-2026-45065: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
1
symfony/validator
v7.1.3
-
Low CVE-2024-50343 Reported 8/30/24CVE-2024-50343: Incorrect response from Validator when input ends with ` `
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.43|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.11|>=7.0.0,<7.1.0|>=7.1.0,<7.1.4- Patched versions
5.4.436.4.117.1.45.4.436.4.117.1.4
4
symfony/yaml
v7.1.1
-
Unrated CVE-2026-45133 Reported 5/20/26CVE-2026-45133: YAML Parser Stack Exhaustion via Unbounded Recursion in Nested Blocks, Sequences, and Mappings
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
-
Unrated CVE-2026-45305 Reported 5/20/26CVE-2026-45305: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
-
Unrated CVE-2026-45304 Reported 5/20/26CVE-2026-45304: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
-
Unrated CVE-2026-109413 Reported 8/30/26CVE-2026-109413: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.54|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.45|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.18|>=8.0.0,<8.1.0|>=8.1.0,<8.1.6
18
twig/twig
v3.10.3
-
High CVE-2024-45411 Reported 9/9/24Twig has a possible sandbox bypass
- Affected versions
>=3.0.0,<3.14.0|>=2.0.0,<2.16.1|>=1.0.0,<1.44.8- Patched versions
1.44.82.16.13.14.0
-
High CVE-2026-49981 Reported 7/1/26Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`
- Affected versions
<=3.26.0- Patched versions
3.27.0
-
Unrated CVE-2026-48806 Reported 5/27/26Sandbox `__toString()` policy bypass via dynamic mapping keys
- Affected versions
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.27.0
https://symfony.com/blog/cve-2026-48806-sandbox-tostring-policy-bypass-via-dynamic-mapping-keys
-
Unrated CVE-2026-46634 Reported 5/20/26`template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name
- Affected versions
>=3.9.0,<3.26.0
-
Low CVE-2024-51755 Reported 11/6/24Unguarded calls to __isset() and to array-accesses when the sandbox is enabled
- Affected versions
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.11.2|>=3.12.0,<3.14.1- Patched versions
3.11.23.14.1
-
Unrated CVE-2026-46638 Reported 5/20/26`{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)
- Affected versions
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.26.0
-
Unrated CVE-2026-47732 Reported 5/20/26Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points
- Affected versions
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.26.0
-
Unrated CVE-2026-48808 Reported 5/27/26Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`
- Affected versions
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.27.0
-
Unrated CVE-2026-48805 Reported 5/27/26Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`
- Affected versions
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.27.0
-
Unrated CVE-2026-24425 Reported 5/20/26Possible sandbox bypass when using a source policy
- Affected versions
>=2.16.0,<3.0.0|>=3.9.0,<3.26.0
-
Unrated CVE-2026-46633 Reported 5/20/26PHP code injection via `{% use %}` template name
- Affected versions
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.26.0
-
Unrated CVE-2026-46627 Reported 5/20/26Sandbox does not protect against resource exhaustion
- Affected versions
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.26.0
-
Unrated CVE-2026-46635 Reported 5/20/26Sandbox property allowlist bypass via the `column` filter (array_column on objects)
- Affected versions
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.26.0
-
Unrated CVE-2026-46628 Reported 5/20/26The `spaceless` filter implicitly marks its output as safe
- Affected versions
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.26.0
-
Unrated CVE-2026-47730 Reported 5/20/26XSS in profiler HtmlDumper via unescaped template and profile names
- Affected versions
>=3.0.0,<3.26.0
-
Unrated CVE-2026-48807 Reported 5/27/26Sandbox `__toString()` policy bypass via `Traversable` in `join`/`replace` and `in`/`not in` operators
- Affected versions
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.27.0
-
Unrated CVE-2026-46636 Reported 5/27/26Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders
- Affected versions
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.27.0
-
Low CVE-2024-51754 Reported 11/6/24Unguarded calls to __toString() when nesting an object into an array
- Affected versions
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.11.2|>=3.12.0,<3.14.1- Patched versions
3.11.23.14.1
https://symfony.com/blog/unguarded-calls-to-__tostring-when-nesting-an-object-into-an-array
Current vulnerabilities
68
Last change
+2
Oct 16, 2026
Abandoned packages
0
Analyses with changes
24
Vulnerabilities by severity
Changes between analyses
Latest changes
-
Oct 16, 2026, 3:04 AM+2 new68 total
-
Aug 4, 2026, 3:04 AM+2 new66 total
-
Jul 22, 2026, 3:04 AM+1 new64 total
-
Jul 21, 2026, 3:04 AM+5 new63 total
-
Jul 2, 2026, 3:07 AM+1 new58 total
-
Jun 20, 2026, 3:02 AM+3 new57 total
-
Jun 19, 2026, 3:02 AM+1 new54 total
-
Jun 13, 2026, 3:03 AM+2 new53 total
-
Jun 6, 2026, 3:04 AM+2 new51 total
-
May 28, 2026, 3:03 AM+7 new49 total
-
May 27, 2026, 3:03 AM+1 new42 total
-
May 21, 2026, 3:04 AM+16 new41 total
-
May 1, 2026, 3:03 AM+25 new25 total
-
Apr 30, 2026, 3:03 AM−25 closed0 total
-
Nov 19, 2025, 2:05 AM+4 new25 total
-
Nov 13, 2025, 2:04 AM+1 new21 total
-
Apr 3, 2025, 3:02 AM+1 new20 total
-
Apr 2, 2025, 3:02 AM+3 new19 total
-
Feb 28, 2025, 2:02 AM+16 new16 total
-
Feb 21, 2025, 3:55 AM−16 closed0 total
-
Dec 11, 2024, 2:02 AM+8 new16 total
-
Nov 7, 2024, 2:34 AM+5 new8 total
-
Sep 24, 2024, 3:34 AM+2 new3 total
-
Sep 10, 2024, 3:34 AM+1 new1 total
Badges
[](https://audit.security.code-rhapsodie.fr/en/project/01915a71-4001-750d-ad7c-c98dcadce439)
[](https://audit.security.code-rhapsodie.fr/en/project/01915a71-4001-750d-ad7c-c98dcadce439)
[](https://audit.security.code-rhapsodie.fr/en/project/01915a71-4001-750d-ad7c-c98dcadce439)
[](https://audit.security.code-rhapsodie.fr/en/project/01915a71-4001-750d-ad7c-c98dcadce439)