prod
Ibexa OSS 4.6
110 vulnérabilités ont été trouvés
6 paquets abandonnés ont été trouvés
Dernière analyse : il y a 1 heure
110
Vulnérabilités
Paquets concernés : 25
- Critique 3
- Haute 30
- Moyenne 33
- Basse 10
- Non classée 3
-
Composer
78
-
Php
32
78
Composer
Vulnérabilités
- Critique 0
- Haute 17
- Moyenne 24
- Basse 6
- Non classée 0
9
guzzlehttp/guzzle
6.5.8
-
Haute CVE-2026-69246 Signalée 03/08/2026Guzzle: Noncanonical host can bypass host-based checks
- Versions affectées
>=8.0.0,<8.0.1|<7.15.2- Versions patchées
7.15.28.0.1
-
Moyenne CVE-2026-55767 Signalée 18/06/2026Dot-only cookie domains match all hosts
- Versions affectées
<7.12.1- Versions patchées
7.12.1
https://github.com/guzzle/guzzle/security/advisories/GHSA-cwxw-98qj-8qjx
-
Moyenne Signalée 20/07/2026Guzzle: Unbounded response cookies risk denial of service
- Versions affectées
<7.15.1- Versions patchées
7.15.1
-
Moyenne CVE-2026-59883 Signalée 20/07/2026Guzzle: Cookie Disclosure and Injection via IP-Address Domains
- Versions affectées
<7.12.3- Versions patchées
7.12.3
-
Moyenne CVE-2026-69245 Signalée 03/08/2026Guzzle: Noncanonical cookie domain keeps subdomain scope
- Versions affectées
>=8.0.0,<8.0.1|<7.15.2- Versions patchées
7.15.28.0.1
-
Moyenne Signalée 20/07/2026Guzzle: URI fragments disclosed in redirect Referer headers
- Versions affectées
<7.15.1- Versions patchées
7.15.1
-
Moyenne CVE-2026-55568 Signalée 18/06/2026Silent HTTPS proxy downgrade to cleartext
- Versions affectées
<7.12.1- Versions patchées
7.12.1
https://github.com/guzzle/guzzle/security/advisories/GHSA-wpwq-4j6v-78m3
-
Moyenne Signalée 20/07/2026Guzzle: Proxy-Authorization headers can be sent to origin servers
- Versions affectées
<7.14.2- Versions patchées
7.14.2
-
Moyenne Signalée 20/07/2026Guzzle: Host-only cookie scope is not preserved
- Versions affectées
<7.15.1- Versions patchées
7.15.1
4
guzzlehttp/psr7
1.9.1
-
Moyenne CVE-2026-55766 Signalée 18/06/2026CRLF injection in HTTP start-line serialization
- Versions affectées
<2.12.1- Versions patchées
2.12.1
https://github.com/guzzle/psr7/security/advisories/GHSA-vm85-hxw5-5432
-
Moyenne CVE-2026-49214 Signalée 11/06/2026guzzlehttp/psr7 has CRLF Injection via URI Host Component
- Versions affectées
<2.10.2- Versions patchées
2.10.2
-
Moyenne CVE-2026-48998 Signalée 11/06/2026guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation
- Versions affectées
<2.10.2- Versions patchées
2.10.2
-
Moyenne CVE-2026-59882 Signalée 21/07/2026guzzlehttp/psr7: Host Confusion via Weak URI Host Validation
- Versions affectées
<2.12.3- Versions patchées
2.12.3
6
ibexa/admin-ui
v4.6.7
-
Haute IBEXA-SA-2024-006 Signalée 28/11/2024XSS in fields used in the Content name pattern
- Versions affectées
v4.0.0,v4.0.8|v4.1.0,v4.1.5|v4.2.0,v4.2.4|v4.3.0,v4.3.5|v4.4.0,v4.4.4|v4.5.0,v4.5.7|v4.6.0,v4.6.13- Versions patchées
v4.6.14
-
Haute IBEXA-SA-2025-003 Signalée 11/06/2025XSS vulnerabilities in back office
- Versions affectées
v4.6.0,v4.6.20- Versions patchées
v4.6.21
https://developers.ibexa.co/security-advisories/ibexa-sa-2025-003-xss-vulnerabilities-in-back-office
-
Moyenne Signalée 13/06/2025Ibexa Admin UI XSS vulnerabilities in back office
- Versions affectées
>=4.6.0-beta1,<4.6.21- Versions patchées
4.6.21
-
Moyenne Signalée 17/10/2025ibexa/admin-ui has an XSS vulnerability in Cancel/Reschedule future publication modal
- Versions affectées
>=4.6.0,<4.6.25|>=5.0.0,<5.0.3- Versions patchées
5.0.34.6.25
-
Moyenne CVE-2024-39318 Signalée 31/07/2024Ibexa Admin UI vulnerable to DOM-based Cross-site Scripting in file upload widget
- Versions affectées
>=4.6.0-beta1,<4.6.9- Versions patchées
4.6.9
-
Moyenne CVE-2024-53864 Signalée 02/12/2024Ibexa Admin UI vulnerable to Cross-site Scripting in a field that is used in the Content name pattern
- Versions affectées
>=4.6.0,<4.6.14- Versions patchées
4.6.14
2
ibexa/admin-ui-assets
v4.6.7
-
Haute IBEXA-SA-2025-003 Signalée 11/06/2025XSS vulnerabilities in back office
- Versions affectées
v4.6.0,v4.6.20- Versions patchées
v4.6.21
https://developers.ibexa.co/security-advisories/ibexa-sa-2025-003-xss-vulnerabilities-in-back-office
-
Moyenne Signalée 13/06/2025Ibexa Admin UI assets XSS vulnerabilities in back office
- Versions affectées
>=4.6.0-alpha1,<4.6.21- Versions patchées
4.6.21
6
ibexa/fieldtype-richtext
v4.6.7
-
Haute IBEXA-SA-2025-002 Signalée 09/04/2025XXE vulnerability in RichText
- Versions affectées
v4.6.0,v4.6.18- Versions patchées
v4.6.19
https://developers.ibexa.co/security-advisories/ibexa-sa-2025-002-xxe-vulnerability-in-richtext
-
Haute IBEXA-SA-2025-003 Signalée 11/06/2025XSS vulnerabilities in back office
- Versions affectées
v4.6.0,v4.6.20- Versions patchées
v4.6.21
https://developers.ibexa.co/security-advisories/ibexa-sa-2025-003-xss-vulnerabilities-in-back-office
-
Haute CVE-2024-43369 Signalée 14/08/2024Persistent Cross-site Scripting in Ibexa RichText Field Type
- Versions affectées
>=4.6.0,<4.6.10- Versions patchées
4.6.10
-
Haute Signalée 10/04/2025ibexa/fieldtype-richtext allows access to external entities in XML
- Versions affectées
>=4.6.0-beta1,<4.6.19- Versions patchées
4.6.19
-
Moyenne Signalée 13/06/2025Ibexa RichText Field Type XSS vulnerabilities in back office
- Versions affectées
>=4.6.0-beta1,<4.6.21- Versions patchées
4.6.21
-
Moyenne Signalée 17/10/2025ibexa/fieldtype-richtext has an XSS vulnerability via acronym custom tag in Rich Text
- Versions affectées
>=4.6.0,<4.6.25|>=5.0.0,<5.0.3- Versions patchées
5.0.34.6.25
2
ibexa/http-cache
v4.6.7
-
Haute IBEXA-SA-2024-006 Signalée 28/11/2024BREACH vulnerability in varnish VCL and vhost templates
- Versions affectées
v4.0.0,v4.0.8|v4.1.0,v4.1.5|v4.2.0,v4.2.4|v4.3.0,v4.3.5|v4.4.0,v4.4.4|v4.5.0,v4.5.7|v4.6.0,v4.6.13- Versions patchées
v4.6.14
-
Moyenne Signalée 02/12/2024ibexa/http-cache affected by Breach with Varnish VCL
- Versions affectées
>=4.6.0,<4.6.14- Versions patchées
4.6.14
2
ibexa/post-install
v4.6.7
-
Haute IBEXA-SA-2024-006 Signalée 28/11/2024BREACH vulnerability in varnish VCL and vhost templates
- Versions affectées
v4.0.0,v4.0.8|v4.1.0,v4.1.5|v4.2.0,v4.2.4|v4.3.0,v4.3.5|v4.4.0,v4.4.4|v4.5.0,v4.5.7|v4.6.0,v4.6.13- Versions patchées
v4.6.14
-
Moyenne Signalée 02/12/2024ibexa/post-install affected by Breach with Varnish VCL
- Versions affectées
>=4.6.0,<4.6.14|>=1.0.0,<1.0.16- Versions patchées
1.0.164.6.14
1
league/flysystem
2.5.0
-
Basse CVE-2026-102601 Signalée 29/09/2026Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter
- Versions affectées
<=3.35.2- Versions patchées
3.35.3
1
symfony/cache
v5.4.40
-
Non classée CVE-2026-45073 Signalée 20/05/2026CVE-2026-45073: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix
- Versions affectées
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
1
symfony/expression-language
v5.4.40
-
Non classée CVE-2026-109449 Signalée 14/10/2026CVE-2026-109449: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process
- Versions affectées
>=2.4.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.54|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.48|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.21|>=8.0.0,<8.1.0|>=8.1.0,<8.1.9
2
symfony/http-client
v5.4.40
-
Non classée CVE-2026-48736 Signalée 26/05/2026CVE-2026-48736: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient
- Versions affectées
>=5.4.0,<5.4.53
-
Basse CVE-2024-50342 Signalée 05/11/2024CVE-2024-50342: Internal address and port enumeration allowed by NoPrivateNetworkHttpClient
- Versions affectées
>=4.3.0,<4.4.0|>=4.4.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.46|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.14|>=7.0.0,<7.1.0|>=7.1.0,<7.1.7- Versions patchées
5.4.466.4.147.1.75.4.466.4.147.1.7
3
symfony/http-foundation
v5.4.40
-
Haute CVE-2025-64500 Signalée 12/11/2025CVE-2025-64500: Incorrect parsing of PATH_INFO can lead to limited authorization bypass
- Versions affectées
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.50|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.29|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.3.7- Versions patchées
5.4.506.4.297.3.75.4.506.4.297.3.7
-
Basse CVE-2024-50345 Signalée 05/11/2024CVE-2024-50345: Open redirect via browser-sanitized URLs
- Versions affectées
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.46|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.14|>=7.0.0,<7.1.0|>=7.1.0,<7.1.7- Versions patchées
5.4.466.4.147.1.75.4.466.4.147.1.7
-
Non classée CVE-2026-108082 Signalée 15/09/2026CVE-2026-108082: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header
- Versions affectées
>=5.4.1,<5.4.54|>=6.0.1,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.46|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.19|>=8.0.0,<8.1.0|>=8.1.0,<8.1.7
2
symfony/mime
v5.4.40
-
Non classée CVE-2026-45067 Signalée 20/05/2026CVE-2026-45067: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
- Versions affectées
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
-
Non classée CVE-2026-45070 Signalée 20/05/2026CVE-2026-45070: Email Header Injection via Non-Token Characters in Mime Parameter Names
- Versions affectées
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
1
symfony/monolog-bridge
v5.4.40
-
Non classée CVE-2026-45077 Signalée 20/05/2026CVE-2026-45077: Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener
- Versions affectées
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
1
symfony/polyfill-intl-idn
v1.30.0
-
Non classée CVE-2026-46644 Signalée 26/05/2026CVE-2026-46644: symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence
- Versions affectées
>=1.17.1,<1.38.1
2
symfony/process
v5.4.40
-
Haute CVE-2024-51736 Signalée 05/11/2024CVE-2024-51736: Command execution hijack on Windows with Process class
- Versions affectées
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.46|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.14|>=7.0.0,<7.1.0|>=7.1.0,<7.1.7- Versions patchées
5.4.466.4.147.1.75.4.466.4.147.1.7
-
Moyenne CVE-2026-24739 Signalée 28/01/2026Symfony's incorrect argument escaping under MSYS2/Git Bash can lead to destructive file operations on Windows
- Versions affectées
>=8.0,<8.0.5|>=7.4,<7.4.5|>=7.3,<7.3.11|>=6.4,<6.4.33|<5.4.51- Versions patchées
5.4.516.4.337.3.117.4.58.0.55.4.516.4.337.3.117.4.58.0.5
2
symfony/routing
v5.4.40
-
Non classée CVE-2026-48784 Signalée 26/05/2026CVE-2026-48784: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization
- Versions affectées
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.53|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.41|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.13|>=8.0.0,<8.0.13
-
Non classée CVE-2026-45065 Signalée 20/05/2026CVE-2026-45065: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection
- Versions affectées
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
1
symfony/runtime
v5.4.40
-
Moyenne CVE-2024-50340 Signalée 05/11/2024CVE-2024-50340: Ability to change environment from query
- Versions affectées
>=5.3.0,<5.4.0|>=5.4.0,<5.4.46|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.14|>=7.0.0,<7.1.0|>=7.1.0,<7.1.7- Versions patchées
5.4.466.4.147.1.75.4.466.4.147.1.7
3
symfony/security-http
v5.4.40
-
Haute CVE-2024-51996 Signalée 13/11/2024CVE-2024-51996: Authentication Bypass via persisted RememberMe cookie
- Versions affectées
>=5.3.0,<5.4.0|>=5.4.0,<5.4.47|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.15|>=7.0.0,<7.1.0|>=7.1.0,<7.1.8- Versions patchées
5.4.476.4.157.1.8
-
Non classée CVE-2026-48489 Signalée 26/05/2026CVE-2026-48489: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
- Versions affectées
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.53|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.41|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.13|>=8.0.0,<8.0.13
-
Non classée CVE-2026-45063 Signalée 20/05/2026CVE-2026-45063: Identity Spoofing via Unanchored DN Regex in X509Authenticator
- Versions affectées
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
1
symfony/validator
v5.4.40
-
Basse CVE-2024-50343 Signalée 30/08/2024CVE-2024-50343: Incorrect response from Validator when input ends with ` `
- Versions affectées
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.43|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.11|>=7.0.0,<7.1.0|>=7.1.0,<7.1.4- Versions patchées
5.4.436.4.117.1.45.4.436.4.117.1.4
4
symfony/yaml
v5.4.40
-
Non classée CVE-2026-45133 Signalée 20/05/2026CVE-2026-45133: YAML Parser Stack Exhaustion via Unbounded Recursion in Nested Blocks, Sequences, and Mappings
- Versions affectées
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
-
Non classée CVE-2026-45305 Signalée 20/05/2026CVE-2026-45305: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex
- Versions affectées
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
-
Non classée CVE-2026-45304 Signalée 20/05/2026CVE-2026-45304: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")
- Versions affectées
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
-
Non classée CVE-2026-109413 Signalée 30/08/2026CVE-2026-109413: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process
- Versions affectées
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.54|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.45|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.18|>=8.0.0,<8.1.0|>=8.1.0,<8.1.6
1
twig/intl-extra
v3.10.0
-
Non classée CVE-2026-46629 Signalée 20/05/2026Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments
- Versions affectées
>=2.12.0,<3.0.0|>=3.0.0,<3.26.0
18
twig/twig
v3.10.3
-
Haute CVE-2024-45411 Signalée 09/09/2024Twig has a possible sandbox bypass
- Versions affectées
>=3.0.0,<3.14.0|>=2.0.0,<2.16.1|>=1.0.0,<1.44.8- Versions patchées
1.44.82.16.13.14.0
-
Haute CVE-2026-49981 Signalée 01/07/2026Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`
- Versions affectées
<=3.26.0- Versions patchées
3.27.0
-
Non classée CVE-2026-48806 Signalée 27/05/2026Sandbox `__toString()` policy bypass via dynamic mapping keys
- Versions affectées
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.27.0
https://symfony.com/blog/cve-2026-48806-sandbox-tostring-policy-bypass-via-dynamic-mapping-keys
-
Non classée CVE-2026-46634 Signalée 20/05/2026`template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name
- Versions affectées
>=3.9.0,<3.26.0
-
Basse CVE-2024-51755 Signalée 06/11/2024Unguarded calls to __isset() and to array-accesses when the sandbox is enabled
- Versions affectées
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.11.2|>=3.12.0,<3.14.1- Versions patchées
3.11.23.14.1
-
Non classée CVE-2026-46638 Signalée 20/05/2026`{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)
- Versions affectées
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.26.0
-
Non classée CVE-2026-47732 Signalée 20/05/2026Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points
- Versions affectées
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.26.0
-
Non classée CVE-2026-48808 Signalée 27/05/2026Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`
- Versions affectées
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.27.0
-
Non classée CVE-2026-48805 Signalée 27/05/2026Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`
- Versions affectées
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.27.0
-
Non classée CVE-2026-24425 Signalée 20/05/2026Possible sandbox bypass when using a source policy
- Versions affectées
>=2.16.0,<3.0.0|>=3.9.0,<3.26.0
-
Non classée CVE-2026-46633 Signalée 20/05/2026PHP code injection via `{% use %}` template name
- Versions affectées
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.26.0
-
Non classée CVE-2026-46627 Signalée 20/05/2026Sandbox does not protect against resource exhaustion
- Versions affectées
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.26.0
-
Non classée CVE-2026-46635 Signalée 20/05/2026Sandbox property allowlist bypass via the `column` filter (array_column on objects)
- Versions affectées
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.26.0
-
Non classée CVE-2026-46628 Signalée 20/05/2026The `spaceless` filter implicitly marks its output as safe
- Versions affectées
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.26.0
-
Non classée CVE-2026-47730 Signalée 20/05/2026XSS in profiler HtmlDumper via unescaped template and profile names
- Versions affectées
>=3.0.0,<3.26.0
-
Non classée CVE-2026-48807 Signalée 27/05/2026Sandbox `__toString()` policy bypass via `Traversable` in `join`/`replace` and `in`/`not in` operators
- Versions affectées
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.27.0
-
Non classée CVE-2026-46636 Signalée 27/05/2026Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders
- Versions affectées
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.27.0
-
Basse CVE-2024-51754 Signalée 06/11/2024Unguarded calls to __toString() when nesting an object into an array
- Versions affectées
>=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.11.2|>=3.12.0,<3.14.1- Versions patchées
3.11.23.14.1
https://symfony.com/blog/unguarded-calls-to-__tostring-when-nesting-an-object-into-an-array
3
webonyx/graphql-php
v14.11.10
-
Haute Signalée 04/05/2026webonyx/graphql-php has quadratic validation cost in OverlappingFieldsCanBeMerged via inline fragments
- Versions affectées
<15.32.2- Versions patchées
15.32.2
-
Haute Signalée 05/05/2026webonyx/graphql-php has unbounded recursion in parser that causes stack overflow on crafted nested input
- Versions affectées
<=15.32.2- Versions patchées
15.32.3
-
Moyenne Signalée 14/04/2026graphql-php is affected by a Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validation
- Versions affectées
<=15.31.4- Versions patchées
15.31.5
32
Php
Vulnérabilités
- Critique 3
- Haute 13
- Moyenne 9
- Basse 4
- Non classée 3
32
PHP
8.3.8
-
Critique CVE-2024-11236 Signalée 24/11/2024In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.
* [https://github.com/php/php-src/security/advisories/GHSA-5hqh-c84r-qjcv](https://github.com/php/php-src/security/advisories/GHSA-5hqh-c84r-qjcv)
-
Critique CVE-2025-1861 Signalée 30/03/2025In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.
* [https://github.com/php/php-src/security/advisories/GHSA-52jp-hrpf-2jff](https://github.com/php/php-src/security/advisories/GHSA-52jp-hrpf-2jff)
* [https://security.netapp.com/advisory/ntap-20250523-0005/](https://security.netapp.com/advisory/ntap-20250523-0005/) -
Critique CVE-2026-6722 Signalée 10/05/2026In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
* [https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5](https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5)
-
Haute CVE-2024-11233 Signalée 24/11/2024In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an error in convert.quoted-printable-decode filter certain data can lead to buffer overread by one byte, which can in certain circumstances lead to crashes or disclose content of other memory areas.
* [https://github.com/php/php-src/security/advisories/GHSA-r977-prxv-hc43](https://github.com/php/php-src/security/advisories/GHSA-r977-prxv-hc43)
-
Haute CVE-2024-11234 Signalée 24/11/2024In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.
* [https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2](https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2)
-
Haute CVE-2024-11235 Signalée 04/04/2025In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??= operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example by supplying specially crafted inputs to the script, it could lead to remote code execution.
- Versions affectées
8.3.0|8.3.18,8.4.0|8.4.5
* [https://github.com/php/php-src/security/advisories/GHSA-rwp7-7vc6-8477](https://github.com/php/php-src/security/advisories/GHSA-rwp7-7vc6-8477)
* [https://github.com/php/php-src/security/advisories/GHSA-rwp7-7vc6-8477](https://github.com/php/php-src/security/advisories/GHSA-rwp7-7vc6-8477) -
Haute CVE-2024-8926 Signalée 08/10/2024In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3 may still be bypassed and the same command injection related to Windows "Best Fit" codepage behavior can be achieved. This may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
* [https://github.com/php/php-src/security/advisories/GHSA-p99j-rfp4-xqvq](https://github.com/php/php-src/security/advisories/GHSA-p99j-rfp4-xqvq)
-
Haute CVE-2024-8927 Signalée 08/10/2024In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP.
* [https://github.com/php/php-src/security/advisories/GHSA-94p6-54jq-9mwp](https://github.com/php/php-src/security/advisories/GHSA-94p6-54jq-9mwp)
-
Haute CVE-2025-14177 Signalée 27/12/2025In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.
* [https://github.com/php/php-src/security/advisories/GHSA-3237-qqm7-mfv7](https://github.com/php/php-src/security/advisories/GHSA-3237-qqm7-mfv7)
-
Haute CVE-2025-14178 Signalée 27/12/2025In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.
* [https://github.com/php/php-src/security/advisories/GHSA-h96m-rvf9-jgm2](https://github.com/php/php-src/security/advisories/GHSA-h96m-rvf9-jgm2)
-
Haute CVE-2025-14179 Signalée 10/05/2026In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
* [https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm](https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm)
-
Haute CVE-2025-14180 Signalée 27/12/2025In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.
* [https://github.com/php/php-src/security/advisories/GHSA-8xr5-qppj-gvwj](https://github.com/php/php-src/security/advisories/GHSA-8xr5-qppj-gvwj)
-
Haute CVE-2025-1735 Signalée 13/07/2025In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.
* [https://github.com/php/php-src/security/advisories/GHSA-hrwm-9436-5mv3](https://github.com/php/php-src/security/advisories/GHSA-hrwm-9436-5mv3)
-
Haute CVE-2025-1736 Signalée 30/03/2025In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line characters may prevent certain headers from being sent or lead to certain headers be misinterpreted.
* [https://github.com/php/php-src/security/advisories/GHSA-hgf5-96fm-v528](https://github.com/php/php-src/security/advisories/GHSA-hgf5-96fm-v528)
* [https://security.netapp.com/advisory/ntap-20250523-0006/](https://security.netapp.com/advisory/ntap-20250523-0006/) -
Haute CVE-2026-17543 Signalée 30/07/2026Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.
* [https://github.com/php/php-src/security/advisories/GHSA-7qpv-r5mr-78m4](https://github.com/php/php-src/security/advisories/GHSA-7qpv-r5mr-78m4)
-
Haute CVE-2026-6735 Signalée 10/05/2026In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.
* [https://github.com/php/php-src/security/advisories/GHSA-7qg2-v9fj-4mwv](https://github.com/php/php-src/security/advisories/GHSA-7qg2-v9fj-4mwv)
-
Moyenne CVE-2024-8925 Signalée 08/10/2024In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.
* [https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32](https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32)
-
Moyenne CVE-2025-1219 Signalée 30/03/2025In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect. This may cause the resulting document to be parsed incorrectly or bypass validations.
- Versions affectées
8.1.0|8.1.31,8.2.0|8.2.27,8.3.0|8.3.18,8.4.0|8.4.4
* [https://github.com/php/php-src/security/advisories/GHSA-p3x9-6h7p-cgfc](https://github.com/php/php-src/security/advisories/GHSA-p3x9-6h7p-cgfc)
* [https://github.com/php/php-src/security/advisories/GHSA-p3x9-6h7p-cgfc](https://github.com/php/php-src/security/advisories/GHSA-p3x9-6h7p-cgfc) -
Moyenne CVE-2025-1220 Signalée 13/07/2025In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() treat the hostname in different way, thus opening way to security problems if the user code implements access checks before access using such functions.
* [https://github.com/php/php-src/security/advisories/GHSA-3cr5-j632-f35r](https://github.com/php/php-src/security/advisories/GHSA-3cr5-j632-f35r)
* [https://github.com/php/php-src/security/advisories/GHSA-3cr5-j632-f35r](https://github.com/php/php-src/security/advisories/GHSA-3cr5-j632-f35r) -
Moyenne CVE-2025-1734 Signalée 30/03/2025In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers.
* [https://github.com/php/php-src/security/advisories/GHSA-pcmh-g36c-qc44](https://github.com/php/php-src/security/advisories/GHSA-pcmh-g36c-qc44)
* [https://security.netapp.com/advisory/ntap-20250523-0009/](https://security.netapp.com/advisory/ntap-20250523-0009/) -
Moyenne CVE-2026-14355 Signalée 03/07/2026In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.
* [https://github.com/php/php-src/security/advisories/GHSA-7jrw-539f-x6vr](https://github.com/php/php-src/security/advisories/GHSA-7jrw-539f-x6vr)
* [https://lists.debian.org/debian-lts-announce/2026/07/msg00010.html](https://lists.debian.org/debian-lts-announce/2026/07/msg00010.html) -
Moyenne CVE-2026-7258 Signalée 10/05/2026In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass signed char to ctype functions (like isxdigit()). On the systems with default signed char and optimized table-lookup ctype functions - such as NetBSD - this can lead to accessing array with negative offset, which can trigger a denial of service.
* [https://github.com/php/php-src/security/advisories/GHSA-m8rr-4c36-8gq4](https://github.com/php/php-src/security/advisories/GHSA-m8rr-4c36-8gq4)
-
Moyenne CVE-2026-7260 Signalée 30/07/2026Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.
* [https://github.com/php/php-src/security/advisories/GHSA-vc5h-9ppw-p5f3](https://github.com/php/php-src/security/advisories/GHSA-vc5h-9ppw-p5f3)
-
Moyenne CVE-2026-7261 Signalée 10/05/2026In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistance is handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-after-free. This may lead to memory corruption, information disclosure, or process crashes, with confidentiality, integrity, and availability impact on the vulnerable system.
* [https://github.com/php/php-src/security/advisories/GHSA-m33r-qmcv-p97q](https://github.com/php/php-src/security/advisories/GHSA-m33r-qmcv-p97q)
-
Moyenne CVE-2026-7568 Signalée 10/05/2026In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metaphone.c uses a signed int variable to track the current position within the input string. If a string longer than 2,147,483,647 bytes is passed, a signed integer overflow occurs, resulting in undefined behavior. This can lead to an out-of-bounds read, causing a segmentation fault or access to unrelated memory, and may affect the availability of the PHP process.
* [https://github.com/php/php-src/security/advisories/GHSA-96wq-48vp-hh57](https://github.com/php/php-src/security/advisories/GHSA-96wq-48vp-hh57)
-
Basse CVE-2024-9026 Signalée 08/10/2024In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.
* [https://github.com/php/php-src/security/advisories/GHSA-865w-9rf3-2wh5](https://github.com/php/php-src/security/advisories/GHSA-865w-9rf3-2wh5)
-
Basse CVE-2025-1217 Signalée 29/03/2025In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when http request module parses HTTP response obtained from a server, folded headers are parsed incorrectly, which may lead to misinterpreting the response and using incorrect headers, MIME types, etc.
- Versions affectées
8.1.0|8.1.31,8.2.0|8.2.27,8.3.0|8.3.18,8.4.0|8.4.4
* [https://github.com/php/php-src/security/advisories/GHSA-v8xr-gpvj-cx9g](https://github.com/php/php-src/security/advisories/GHSA-v8xr-gpvj-cx9g)
* [https://github.com/php/php-src/security/advisories/GHSA-v8xr-gpvj-cx9g](https://github.com/php/php-src/security/advisories/GHSA-v8xr-gpvj-cx9g) -
Basse CVE-2026-7259 Signalée 10/05/2026In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to mb_regex_encoding().
* [https://github.com/php/php-src/security/advisories/GHSA-wm6j-2649-pv75](https://github.com/php/php-src/security/advisories/GHSA-wm6j-2649-pv75)
-
Basse CVE-2026-7262 Signalée 10/05/2026In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of missing value element. This leads to dereferences a NULL pointer, causing a segmentation fault. This allows a remote unauthenticated attacker to crash the PHP SOAP server process, resulting in denial of service.
* [https://github.com/php/php-src/security/advisories/GHSA-hmxp-6pc4-f3vv](https://github.com/php/php-src/security/advisories/GHSA-hmxp-6pc4-f3vv)
-
Non classée CVE-2024-8929 Signalée 22/11/2024In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different users of the same server.
* [https://github.com/php/php-src/security/advisories/GHSA-h35g-vwh6-m678](https://github.com/php/php-src/security/advisories/GHSA-h35g-vwh6-m678)
* [https://security.netapp.com/advisory/ntap-20250110-0008/](https://security.netapp.com/advisory/ntap-20250110-0008/) -
Non classée CVE-2024-8932 Signalée 22/11/2024In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.
* [https://github.com/php/php-src/security/advisories/GHSA-g665-fm4p-vhff](https://github.com/php/php-src/security/advisories/GHSA-g665-fm4p-vhff)
* [https://security.netapp.com/advisory/ntap-20250110-0009/](https://security.netapp.com/advisory/ntap-20250110-0009/) -
Non classée CVE-2025-6491 Signalée 13/07/2025In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server.
* [https://github.com/php/php-src/security/advisories/GHSA-453j-q27h-5p8x](https://github.com/php/php-src/security/advisories/GHSA-453j-q27h-5p8x)
* [https://github.com/php/php-src/security/advisories/GHSA-453j-q27h-5p8x](https://github.com/php/php-src/security/advisories/GHSA-453j-q27h-5p8x)
6
Paquets abandonnés
à remplacer ou à surveiller
- sensio/framework-extra-bundle Symfony
- php-http/message-factory psr/http-factory
- platformsh/symfonyflex-bridge Aucun
- swiftmailer/swiftmailer symfony/mailer
- symfony/swiftmailer-bundle symfony/mailer
- php-http/guzzle6-adapter guzzlehttp/guzzle or php-http/guzzle7-adapter
Votre version est Ibexa 4.6
Version maintenue
Votre version est Symfony 5.4
Correctifs de sécurité uniquement
Votre version est Php 7.4
Fin de vie
Vulnérabilités actuelles
110
Dernière variation
+3
16 oct. 2026
Paquets abandonnés
6
Analyses avec changement
64
Vulnérabilités par sévérité
Variations entre les analyses
Dernières variations
-
16 oct. 2026, 03:04+3 nouvelles110 au total
-
1 oct. 2026, 16:09+32 nouvelles107 au total
-
30 sept. 2026, 03:04+1 nouvelles75 au total
-
24 sept. 2026, 03:03−34 fermées74 au total
-
7 août 2026, 03:03+2 nouvelles108 au total
-
4 août 2026, 03:03+2 nouvelles106 au total
-
22 juil. 2026, 03:03+1 nouvelles104 au total
-
21 juil. 2026, 03:03+5 nouvelles103 au total
-
10 juil. 2026, 03:02+1 nouvelles98 au total
-
8 juil. 2026, 03:02+66 nouvelles +6 abandonnés97 au total
-
7 juil. 2026, 03:02−35 fermées −6 abandonnés31 au total
-
2 juil. 2026, 03:06+1 nouvelles66 au total
-
1 juil. 2026, 03:06−31 fermées65 au total
-
20 juin 2026, 03:02+3 nouvelles96 au total
-
13 juin 2026, 03:03+2 nouvelles93 au total
-
28 mai 2026, 03:03+8 nouvelles91 au total
-
27 mai 2026, 03:03+1 nouvelles83 au total
-
21 mai 2026, 03:03+19 nouvelles82 au total
-
14 mai 2026, 03:03+8 nouvelles63 au total
-
6 mai 2026, 03:03+1 nouvelles55 au total
-
5 mai 2026, 03:03+1 nouvelles54 au total
-
1 mai 2026, 03:03+30 nouvelles +6 abandonnés53 au total
-
30 avr. 2026, 03:02−30 fermées −6 abandonnés23 au total
-
15 avr. 2026, 03:03+1 nouvelles53 au total
-
29 janv. 2026, 02:04+1 nouvelles52 au total
-
11 janv. 2026, 02:04+2 nouvelles51 au total
-
10 janv. 2026, 02:04+1 nouvelles49 au total
-
10 déc. 2025, 02:04+20 nouvelles48 au total
-
9 déc. 2025, 02:04−20 fermées28 au total
-
13 nov. 2025, 02:04+1 nouvelles48 au total
-
18 oct. 2025, 03:04+2 nouvelles47 au total
-
8 oct. 2025, 03:04−1 fermées45 au total
-
21 août 2025, 03:03+4 nouvelles46 au total
-
5 août 2025, 03:04+16 nouvelles42 au total
-
31 juil. 2025, 03:06−16 fermées26 au total
-
24 juil. 2025, 03:04+3 nouvelles42 au total
-
7 juil. 2025, 03:04+5 nouvelles39 au total
-
19 juin 2025, 03:02+1 nouvelles34 au total
-
14 juin 2025, 03:02+3 nouvelles33 au total
-
13 juin 2025, 03:02+3 nouvelles30 au total
-
3 mai 2025, 03:02+1 nouvelles27 au total
-
2 mai 2025, 03:02+1 nouvelles26 au total
-
17 avr. 2025, 03:02+1 nouvelles25 au total
-
11 avr. 2025, 03:02+1 nouvelles24 au total
-
10 avr. 2025, 03:02+1 nouvelles23 au total
-
28 févr. 2025, 02:02+22 nouvelles +6 abandonnés22 au total
-
21 févr. 2025, 03:39−22 fermées −6 abandonnés0 au total
-
4 déc. 2024, 02:02−1 fermées22 au total
-
3 déc. 2024, 02:02+5 nouvelles23 au total
-
30 nov. 2024, 02:02+3 nouvelles18 au total
-
28 nov. 2024, 02:02+3 nouvelles15 au total
-
26 nov. 2024, 02:02+11 nouvelles +6 abandonnés12 au total
-
25 nov. 2024, 02:02−11 fermées −6 abandonnés1 au total
-
14 nov. 2024, 02:02+1 nouvelles12 au total
-
9 nov. 2024, 02:02+1 nouvelles11 au total
-
7 nov. 2024, 02:28+7 nouvelles10 au total
-
6 nov. 2024, 02:28+3 nouvelles +6 abandonnés3 au total
-
5 nov. 2024, 02:39−3 fermées −6 abandonnés0 au total
-
10 sept. 2024, 03:28+1 nouvelles3 au total
-
15 août 2024, 03:28+1 nouvelles2 au total
-
1 août 2024, 03:28+1 nouvelles1 au total
-
24 juil. 2024, 03:30−1 fermées0 au total
-
12 juil. 2024, 08:53+1 nouvelles1 au total
-
3 juin 2024, 17:14−1 fermées0 au total
Badges
[](https://audit.security.code-rhapsodie.fr/fr/project/018fdea7-1ba2-7bdf-abab-51452e155926)
[](https://audit.security.code-rhapsodie.fr/fr/project/018fdea7-1ba2-7bdf-abab-51452e155926)
[](https://audit.security.code-rhapsodie.fr/fr/project/018fdea7-1ba2-7bdf-abab-51452e155926)
[](https://audit.security.code-rhapsodie.fr/fr/project/018fdea7-1ba2-7bdf-abab-51452e155926)