{"advisories":{"paragonie\/halite":[{"advisoryId":"PKSA-rpfb-zysg-cdwj","packageName":"paragonie\/halite","remoteId":"paragonie\/halite\/2026-11-06.yaml","title":"AAD parameter not correctly bound in File cryptography","link":"https:\/\/github.com\/paragonie\/halite\/security\/advisories\/GHSA-jw8x-c445-phrm","cve":null,"affectedVersions":"\u003E=5,\u003C5.1.5","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-06 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"paragonie\/halite\/2026-11-06.yaml"}]}],"prinsfrank\/pdfparser":[{"advisoryId":"PKSA-q45b-45bz-1zpb","packageName":"prinsfrank\/pdfparser","remoteId":"prinsfrank\/pdfparser\/2026-11-05-2.yaml","title":"Unbounded recursion in compressed object resolution","link":"https:\/\/github.com\/PrinsFrank\/pdfparser\/security\/advisories\/GHSA-j946-cc6f-666c","cve":null,"affectedVersions":"\u003E=0.0.0,\u003C1.0.0|\u003E=1.0.0,\u003C2.0.0|\u003E=2.0.0,\u003C2.9.0|\u003E=3.0.0,\u003C3.9.0|\u003E=4.0.0,\u003C4.3.0","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-05 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"prinsfrank\/pdfparser\/2026-11-05-2.yaml"}]},{"advisoryId":"PKSA-6qxm-qgqx-6shn","packageName":"prinsfrank\/pdfparser","remoteId":"prinsfrank\/pdfparser\/2026-11-05-1.yaml","title":"Memory exhaustion when decoding malicious zlib\/deflate streams","link":"https:\/\/github.com\/PrinsFrank\/pdfparser\/security\/advisories\/GHSA-gv74-739g-57r7","cve":null,"affectedVersions":"\u003E=0.0.0,\u003C1.0.0|\u003E=1.0.0,\u003C2.0.0|\u003E=2.0.0,\u003C2.9.0|\u003E=3.0.0,\u003C3.9.0|\u003E=4.0.0,\u003C4.3.0","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-05 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"prinsfrank\/pdfparser\/2026-11-05-1.yaml"}]}],"symfony\/validator":[{"advisoryId":"PKSA-68kf-8d6f-hdsy","packageName":"symfony\/validator","remoteId":"symfony\/validator\/2026-11-04-7.yaml","title":"Ip Constraint public\/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses: SSRF Filter Bypass","link":"https:\/\/github.com\/symfony\/symfony\/security\/advisories\/GHSA-4qpf-57w4-m3wc","cve":null,"affectedVersions":"\u003E=2.0.0,\u003C3.0.0|\u003E=3.0.0,\u003C4.0.0|\u003E=4.0.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.56|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.50|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/validator\/2026-11-04-7.yaml"}]}],"symfony\/http-foundation":[{"advisoryId":"PKSA-24ph-xkrh-y79j","packageName":"symfony\/http-foundation","remoteId":"symfony\/http-foundation\/CVE-2026-118514.yaml","title":"CVE-2026-118514: HEAD Requests Bypass the methods Option of security.access_control Rules and Firewalls: Incomplete Fix for CVE-2026-45075","link":"https:\/\/symfony.com\/cve-2026-118514","cve":"CVE-2026-118514","affectedVersions":"\u003E=2.0.0,\u003C3.0.0|\u003E=3.0.0,\u003C4.0.0|\u003E=4.0.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.56|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.50|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 10:45:07","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/http-foundation\/CVE-2026-118514.yaml"}]},{"advisoryId":"PKSA-pr6q-2w5s-kzzf","packageName":"symfony\/http-foundation","remoteId":"symfony\/http-foundation\/2026-11-04-21.yaml","title":"Path Rules Enforced in Front of PHP Can Be Bypassed by Appending the Path to the Script Name","link":"https:\/\/github.com\/symfony\/symfony\/security\/advisories\/GHSA-3h27-hjv7-fqjx","cve":null,"affectedVersions":"\u003E=5.4.50,\u003C5.4.56|\u003E=6.4.29,\u003C6.4.50|\u003E=7.3.7,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/http-foundation\/2026-11-04-21.yaml"}]},{"advisoryId":"PKSA-nxjs-s6hn-vb6m","packageName":"symfony\/http-foundation","remoteId":"symfony\/http-foundation\/2026-11-04-9.yaml","title":"The \u0022private_ranges\u0022 Trusted Proxies Shortcut Trusts Clients Presenting an IPv4-Mapped, 6to4, Teredo or NAT64 Address as Reverse Proxies","link":"https:\/\/github.com\/symfony\/symfony\/security\/advisories\/GHSA-xg2q-4rrq-657q","cve":null,"affectedVersions":"\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/http-foundation\/2026-11-04-9.yaml"}]},{"advisoryId":"PKSA-b2gg-vk1g-6d5q","packageName":"symfony\/http-foundation","remoteId":"symfony\/http-foundation\/2026-11-04-22.yaml","title":"Generated URLs Can Point to a Host Chosen by the Client","link":"https:\/\/github.com\/symfony\/symfony\/security\/advisories\/GHSA-5mx8-mwrp-5693","cve":null,"affectedVersions":"\u003E=2.0.0,\u003C2.1.0|\u003E=2.1.0,\u003C2.2.0|\u003E=2.2.0,\u003C2.3.0|\u003E=2.3.0,\u003C2.4.0|\u003E=2.4.0,\u003C2.5.0|\u003E=2.5.0,\u003C2.6.0|\u003E=2.6.0,\u003C2.7.0|\u003E=2.7.0,\u003C2.8.0|\u003E=2.8.0,\u003C3.0.0|\u003E=3.0.0,\u003C3.1.0|\u003E=3.1.0,\u003C3.2.0|\u003E=3.2.0,\u003C3.3.0|\u003E=3.3.0,\u003C3.4.0|\u003E=3.4.0,\u003C4.0.0|\u003E=4.0.0,\u003C4.1.0|\u003E=4.1.0,\u003C4.2.0|\u003E=4.2.0,\u003C4.3.0|\u003E=4.3.0,\u003C4.4.0|\u003E=4.4.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.56|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.50|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/http-foundation\/2026-11-04-22.yaml"}]}],"symfony\/symfony":[{"advisoryId":"PKSA-wjdj-twpp-mc62","packageName":"symfony\/symfony","remoteId":"symfony\/symfony\/2026-11-04-19.yaml","title":"Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document Hold a Process","link":"https:\/\/github.com\/symfony\/symfony\/security\/advisories\/GHSA-hwfg-qwvh-2wfx","cve":null,"affectedVersions":"\u003E=2.0.0,\u003C3.0.0|\u003E=3.0.0,\u003C4.0.0|\u003E=4.0.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.56|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.50|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/symfony\/2026-11-04-19.yaml"}]},{"advisoryId":"PKSA-qsv5-t2f9-c4xk","packageName":"symfony\/symfony","remoteId":"symfony\/symfony\/2026-11-04-17.yaml","title":"DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files, Letting a Client Read Any Server File","link":"https:\/\/github.com\/symfony\/symfony\/security\/advisories\/GHSA-pxj9-jh84-vhm5","cve":null,"affectedVersions":"\u003E=2.0.0,\u003C3.0.0|\u003E=3.0.0,\u003C4.0.0|\u003E=4.0.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.56|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.50|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/symfony\/2026-11-04-17.yaml"}]},{"advisoryId":"PKSA-8s76-qdyv-tvyf","packageName":"symfony\/symfony","remoteId":"symfony\/symfony\/CVE-2026-118513.yaml","title":"CVE-2026-118513: X509Authenticator and X509AuthenticationListener Read Escaped RFC 2253 Commas and Bare Slashes Inside a DN Value as RDN Boundaries: Incomplete Fix for CVE-2026-45063","link":"https:\/\/symfony.com\/cve-2026-118513","cve":"CVE-2026-118513","affectedVersions":"\u003E=2.0.0,\u003C3.0.0|\u003E=3.0.0,\u003C4.0.0|\u003E=4.0.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.56|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.50|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 10:45:07","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/symfony\/CVE-2026-118513.yaml"}]},{"advisoryId":"PKSA-f5bc-pjy2-fy75","packageName":"symfony\/symfony","remoteId":"symfony\/symfony\/2026-11-04-6.yaml","title":"ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested Objects","link":"https:\/\/github.com\/symfony\/symfony\/security\/advisories\/GHSA-hqp2-7rr8-hf26","cve":null,"affectedVersions":"\u003E=5.4.41,\u003C5.4.56|\u003E=6.4.9,\u003C6.4.50|\u003E=7.0.9,\u003C7.1.0|\u003E=7.1.2,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/symfony\/2026-11-04-6.yaml"}]},{"advisoryId":"PKSA-ct6b-k8d9-m631","packageName":"symfony\/symfony","remoteId":"symfony\/symfony\/2026-11-04-14.yaml","title":"Programmatic Logins Skip the checkPostAuth() Method of User Checkers","link":"https:\/\/github.com\/symfony\/symfony\/security\/advisories\/GHSA-8f57-m8wj-x65w","cve":null,"affectedVersions":"\u003E=5.2.2,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.56|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.50|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/symfony\/2026-11-04-14.yaml"}]},{"advisoryId":"PKSA-fnqz-pbgw-j1pd","packageName":"symfony\/symfony","remoteId":"symfony\/symfony\/CVE-2026-118515.yaml","title":"CVE-2026-118515: The Serializer Builds UploadedFile Objects From Request Data, Letting a Client Point an Upload at Any Server File","link":"https:\/\/symfony.com\/cve-2026-118515","cve":"CVE-2026-118515","affectedVersions":"\u003E=2.0.0,\u003C3.0.0|\u003E=3.0.0,\u003C4.0.0|\u003E=4.0.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.56|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.50|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 10:45:07","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/symfony\/CVE-2026-118515.yaml"}]},{"advisoryId":"PKSA-t3wq-xfwt-t1h9","packageName":"symfony\/symfony","remoteId":"symfony\/symfony\/2026-11-04-2.yaml","title":"HtmlSanitizer Does Not URL-Sanitize srcset and imagesrcset: Media Scheme and Host Allow-List Bypass","link":"https:\/\/github.com\/symfony\/symfony\/security\/advisories\/GHSA-q8jq-xrf4-v5j8","cve":null,"affectedVersions":"\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.50|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/symfony\/2026-11-04-2.yaml"}]},{"advisoryId":"PKSA-7pdq-dz64-7s51","packageName":"symfony\/symfony","remoteId":"symfony\/symfony\/CVE-2026-118514.yaml","title":"CVE-2026-118514: HEAD Requests Bypass the methods Option of security.access_control Rules and Firewalls: Incomplete Fix for CVE-2026-45075","link":"https:\/\/symfony.com\/cve-2026-118514","cve":"CVE-2026-118514","affectedVersions":"\u003E=2.0.0,\u003C3.0.0|\u003E=3.0.0,\u003C4.0.0|\u003E=4.0.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.56|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.50|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 10:45:07","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/symfony\/CVE-2026-118514.yaml"}]},{"advisoryId":"PKSA-py6w-7ynw-bn9j","packageName":"symfony\/symfony","remoteId":"symfony\/symfony\/CVE-2026-118516.yaml","title":"CVE-2026-118516: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control","link":"https:\/\/symfony.com\/cve-2026-118516","cve":"CVE-2026-118516","affectedVersions":"\u003E=4.1.0,\u003C4.2.0|\u003E=4.2.0,\u003C4.3.0|\u003E=4.3.0,\u003C4.4.0|\u003E=4.4.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.56|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.50|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 10:45:07","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/symfony\/CVE-2026-118516.yaml"}]},{"advisoryId":"PKSA-6z8s-hntv-3x7z","packageName":"symfony\/symfony","remoteId":"symfony\/symfony\/2026-11-04-21.yaml","title":"Path Rules Enforced in Front of PHP Can Be Bypassed by Appending the Path to the Script Name","link":"https:\/\/github.com\/symfony\/symfony\/security\/advisories\/GHSA-3h27-hjv7-fqjx","cve":null,"affectedVersions":"\u003E=5.4.50,\u003C5.4.56|\u003E=6.4.29,\u003C6.4.50|\u003E=7.3.7,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/symfony\/2026-11-04-21.yaml"}]},{"advisoryId":"PKSA-yk9m-qbjr-81kg","packageName":"symfony\/symfony","remoteId":"symfony\/symfony\/2026-11-04-10.yaml","title":"ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References","link":"https:\/\/github.com\/symfony\/symfony\/security\/advisories\/GHSA-gq53-v8w2-gjhj","cve":null,"affectedVersions":"\u003E=4.3.0,\u003C4.4.0|\u003E=4.4.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.56|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.50|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/symfony\/2026-11-04-10.yaml"}]},{"advisoryId":"PKSA-j458-vmkj-zs4x","packageName":"symfony\/symfony","remoteId":"symfony\/symfony\/2026-11-04-1.yaml","title":"XXE (Local File Read) in Config XmlUtils::parse() via validateOnParse = true","link":"https:\/\/github.com\/symfony\/symfony\/security\/advisories\/GHSA-5jff-8h8q-r5qx","cve":null,"affectedVersions":"\u003E=2.0.0,\u003C3.0.0|\u003E=3.0.0,\u003C4.0.0|\u003E=4.0.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.56|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.50|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/symfony\/2026-11-04-1.yaml"}]},{"advisoryId":"PKSA-zt69-bd63-2wsb","packageName":"symfony\/symfony","remoteId":"symfony\/symfony\/2026-11-04-3.yaml","title":"HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar: Incomplete Fix for CVE-2026-48761","link":"https:\/\/github.com\/symfony\/symfony\/security\/advisories\/GHSA-wm2w-4mgj-vw33","cve":null,"affectedVersions":"\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.50|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/symfony\/2026-11-04-3.yaml"}]},{"advisoryId":"PKSA-68d7-b14m-3bjc","packageName":"symfony\/symfony","remoteId":"symfony\/symfony\/2026-11-04-11.yaml","title":"Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main Request","link":"https:\/\/github.com\/symfony\/symfony\/security\/advisories\/GHSA-wg5q-m2ww-f3c9","cve":null,"affectedVersions":"\u003E=2.8.44,\u003C3.0.0|\u003E=3.4.14,\u003C4.0.0|\u003E=4.0.14,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.56|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.50|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/symfony\/2026-11-04-11.yaml"}]},{"advisoryId":"PKSA-fz6m-r4pd-17c9","packageName":"symfony\/symfony","remoteId":"symfony\/symfony\/2026-11-04-18.yaml","title":"Filesystem Path Treats Any Prefix Before \u0022:\/\/\u0022 as a Root, Letting Paths Escape Their Base Directory","link":"https:\/\/github.com\/symfony\/symfony\/security\/advisories\/GHSA-6prc-h956-hxjq","cve":null,"affectedVersions":"\u003E=5.4.0,\u003C5.4.56|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.50|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/symfony\/2026-11-04-18.yaml"}]},{"advisoryId":"PKSA-mk2k-pp4j-3cvq","packageName":"symfony\/symfony","remoteId":"symfony\/symfony\/2026-11-04-7.yaml","title":"Ip Constraint public\/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses: SSRF Filter Bypass","link":"https:\/\/github.com\/symfony\/symfony\/security\/advisories\/GHSA-4qpf-57w4-m3wc","cve":null,"affectedVersions":"\u003E=2.0.0,\u003C3.0.0|\u003E=3.0.0,\u003C4.0.0|\u003E=4.0.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.56|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.50|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/symfony\/2026-11-04-7.yaml"}]},{"advisoryId":"PKSA-rnyk-qk9h-pjq2","packageName":"symfony\/symfony","remoteId":"symfony\/symfony\/2026-11-04-9.yaml","title":"The \u0022private_ranges\u0022 Trusted Proxies Shortcut Trusts Clients Presenting an IPv4-Mapped, 6to4, Teredo or NAT64 Address as Reverse Proxies","link":"https:\/\/github.com\/symfony\/symfony\/security\/advisories\/GHSA-xg2q-4rrq-657q","cve":null,"affectedVersions":"\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/symfony\/2026-11-04-9.yaml"}]},{"advisoryId":"PKSA-d219-wydc-sszs","packageName":"symfony\/symfony","remoteId":"symfony\/symfony\/2026-11-04-22.yaml","title":"Generated URLs Can Point to a Host Chosen by the Client","link":"https:\/\/github.com\/symfony\/symfony\/security\/advisories\/GHSA-5mx8-mwrp-5693","cve":null,"affectedVersions":"\u003E=2.0.0,\u003C2.1.0|\u003E=2.1.0,\u003C2.2.0|\u003E=2.2.0,\u003C2.3.0|\u003E=2.3.0,\u003C2.4.0|\u003E=2.4.0,\u003C2.5.0|\u003E=2.5.0,\u003C2.6.0|\u003E=2.6.0,\u003C2.7.0|\u003E=2.7.0,\u003C2.8.0|\u003E=2.8.0,\u003C3.0.0|\u003E=3.0.0,\u003C3.1.0|\u003E=3.1.0,\u003C3.2.0|\u003E=3.2.0,\u003C3.3.0|\u003E=3.3.0,\u003C3.4.0|\u003E=3.4.0,\u003C4.0.0|\u003E=4.0.0,\u003C4.1.0|\u003E=4.1.0,\u003C4.2.0|\u003E=4.2.0,\u003C4.3.0|\u003E=4.3.0,\u003C4.4.0|\u003E=4.4.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.56|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.50|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/symfony\/2026-11-04-22.yaml"}]},{"advisoryId":"PKSA-gd5w-xsj1-63jv","packageName":"symfony\/symfony","remoteId":"symfony\/symfony\/2026-11-04-15.yaml","title":"NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports: Incomplete Fix for CVE-2024-50342","link":"https:\/\/github.com\/symfony\/symfony\/security\/advisories\/GHSA-c7hm-wqwp-f9v8","cve":null,"affectedVersions":"\u003E=4.3.0,\u003C4.4.0|\u003E=4.4.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.56|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.50|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/symfony\/2026-11-04-15.yaml"}]},{"advisoryId":"PKSA-qrw8-twh8-c9t6","packageName":"symfony\/symfony","remoteId":"symfony\/symfony\/2026-11-04-20.yaml","title":"Incomplete Fix for CVE-2026-45756: JsonPath Queries Can Still Hold a Process Through search(), match() and Chained Filters","link":"https:\/\/github.com\/symfony\/symfony\/security\/advisories\/GHSA-cpww-5vpx-72x7","cve":null,"affectedVersions":"\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/symfony\/2026-11-04-20.yaml"}]},{"advisoryId":"PKSA-66zq-5hky-mbzt","packageName":"symfony\/symfony","remoteId":"symfony\/symfony\/CVE-2026-118517.yaml","title":"CVE-2026-118517: HtmlSanitizer allowLinkHosts() \/ allowMediaHosts() Bypass via URLs Without a Well-Formed Authority: Incomplete Fix for CVE-2026-45066","link":"https:\/\/symfony.com\/cve-2026-118517","cve":"CVE-2026-118517","affectedVersions":"\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.50|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 11:23:22","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/symfony\/CVE-2026-118517.yaml"}]}],"symfony\/yaml":[{"advisoryId":"PKSA-nktx-f1n1-b4yd","packageName":"symfony\/yaml","remoteId":"symfony\/yaml\/2026-11-04-19.yaml","title":"Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document Hold a Process","link":"https:\/\/github.com\/symfony\/symfony\/security\/advisories\/GHSA-hwfg-qwvh-2wfx","cve":null,"affectedVersions":"\u003E=2.0.0,\u003C3.0.0|\u003E=3.0.0,\u003C4.0.0|\u003E=4.0.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.56|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.50|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/yaml\/2026-11-04-19.yaml"}]}],"symfony\/security-http":[{"advisoryId":"PKSA-k1xt-28gt-fw9y","packageName":"symfony\/security-http","remoteId":"symfony\/security-http\/CVE-2026-118513.yaml","title":"CVE-2026-118513: X509Authenticator and X509AuthenticationListener Read Escaped RFC 2253 Commas and Bare Slashes Inside a DN Value as RDN Boundaries: Incomplete Fix for CVE-2026-45063","link":"https:\/\/symfony.com\/cve-2026-118513","cve":"CVE-2026-118513","affectedVersions":"\u003E=2.0.0,\u003C3.0.0|\u003E=3.0.0,\u003C4.0.0|\u003E=4.0.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.56|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.50|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 10:45:07","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/security-http\/CVE-2026-118513.yaml"}]},{"advisoryId":"PKSA-jvjt-tspc-256s","packageName":"symfony\/security-http","remoteId":"symfony\/security-http\/2026-11-04-14.yaml","title":"Programmatic Logins Skip the checkPostAuth() Method of User Checkers","link":"https:\/\/github.com\/symfony\/symfony\/security\/advisories\/GHSA-8f57-m8wj-x65w","cve":null,"affectedVersions":"\u003E=5.2.2,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.56|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.50|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/security-http\/2026-11-04-14.yaml"}]}],"symfony\/http-kernel":[{"advisoryId":"PKSA-3gxv-7xhq-mgmz","packageName":"symfony\/http-kernel","remoteId":"symfony\/http-kernel\/2026-11-04-11.yaml","title":"Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main Request","link":"https:\/\/github.com\/symfony\/symfony\/security\/advisories\/GHSA-wg5q-m2ww-f3c9","cve":null,"affectedVersions":"\u003E=2.8.44,\u003C3.0.0|\u003E=3.4.14,\u003C4.0.0|\u003E=4.0.14,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.56|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.50|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/http-kernel\/2026-11-04-11.yaml"}]}],"symfony\/http-client":[{"advisoryId":"PKSA-yd1s-kk7g-k2j3","packageName":"symfony\/http-client","remoteId":"symfony\/http-client\/2026-11-04-10.yaml","title":"ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References","link":"https:\/\/github.com\/symfony\/symfony\/security\/advisories\/GHSA-gq53-v8w2-gjhj","cve":null,"affectedVersions":"\u003E=4.3.0,\u003C4.4.0|\u003E=4.4.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.56|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.50|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/http-client\/2026-11-04-10.yaml"}]},{"advisoryId":"PKSA-gfw6-4rnd-4533","packageName":"symfony\/http-client","remoteId":"symfony\/http-client\/2026-11-04-15.yaml","title":"NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports: Incomplete Fix for CVE-2024-50342","link":"https:\/\/github.com\/symfony\/symfony\/security\/advisories\/GHSA-c7hm-wqwp-f9v8","cve":null,"affectedVersions":"\u003E=4.3.0,\u003C4.4.0|\u003E=4.4.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.56|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.50|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/http-client\/2026-11-04-15.yaml"}]}],"symfony\/routing":[{"advisoryId":"PKSA-y8c5-1b7f-r1gj","packageName":"symfony\/routing","remoteId":"symfony\/routing\/CVE-2026-118516.yaml","title":"CVE-2026-118516: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control","link":"https:\/\/symfony.com\/cve-2026-118516","cve":"CVE-2026-118516","affectedVersions":"\u003E=4.1.0,\u003C4.2.0|\u003E=4.2.0,\u003C4.3.0|\u003E=4.3.0,\u003C4.4.0|\u003E=4.4.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.56|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.50|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 10:45:07","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/routing\/CVE-2026-118516.yaml"}]}],"symfony\/framework-bundle":[{"advisoryId":"PKSA-jvt1-tggb-8w72","packageName":"symfony\/framework-bundle","remoteId":"symfony\/framework-bundle\/2026-11-04-9.yaml","title":"The \u0022private_ranges\u0022 Trusted Proxies Shortcut Trusts Clients Presenting an IPv4-Mapped, 6to4, Teredo or NAT64 Address as Reverse Proxies","link":"https:\/\/github.com\/symfony\/symfony\/security\/advisories\/GHSA-xg2q-4rrq-657q","cve":null,"affectedVersions":"\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/framework-bundle\/2026-11-04-9.yaml"}]}],"symfony\/filesystem":[{"advisoryId":"PKSA-g499-cm4q-v35y","packageName":"symfony\/filesystem","remoteId":"symfony\/filesystem\/2026-11-04-18.yaml","title":"Filesystem Path Treats Any Prefix Before \u0022:\/\/\u0022 as a Root, Letting Paths Escape Their Base Directory","link":"https:\/\/github.com\/symfony\/symfony\/security\/advisories\/GHSA-6prc-h956-hxjq","cve":null,"affectedVersions":"\u003E=5.4.0,\u003C5.4.56|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.50|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/filesystem\/2026-11-04-18.yaml"}]}],"symfony\/serializer":[{"advisoryId":"PKSA-nyd8-k74r-fsf2","packageName":"symfony\/serializer","remoteId":"symfony\/serializer\/2026-11-04-17.yaml","title":"DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files, Letting a Client Read Any Server File","link":"https:\/\/github.com\/symfony\/symfony\/security\/advisories\/GHSA-pxj9-jh84-vhm5","cve":null,"affectedVersions":"\u003E=2.0.0,\u003C3.0.0|\u003E=3.0.0,\u003C4.0.0|\u003E=4.0.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.56|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.50|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/serializer\/2026-11-04-17.yaml"}]},{"advisoryId":"PKSA-y18k-qjc6-knrv","packageName":"symfony\/serializer","remoteId":"symfony\/serializer\/2026-11-04-6.yaml","title":"ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested Objects","link":"https:\/\/github.com\/symfony\/symfony\/security\/advisories\/GHSA-hqp2-7rr8-hf26","cve":null,"affectedVersions":"\u003E=5.4.41,\u003C5.4.56|\u003E=6.4.9,\u003C6.4.50|\u003E=7.0.9,\u003C7.1.0|\u003E=7.1.2,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/serializer\/2026-11-04-6.yaml"}]},{"advisoryId":"PKSA-grh8-hvfp-h9pf","packageName":"symfony\/serializer","remoteId":"symfony\/serializer\/CVE-2026-118515.yaml","title":"CVE-2026-118515: The Serializer Builds UploadedFile Objects From Request Data, Letting a Client Point an Upload at Any Server File","link":"https:\/\/symfony.com\/cve-2026-118515","cve":"CVE-2026-118515","affectedVersions":"\u003E=2.0.0,\u003C3.0.0|\u003E=3.0.0,\u003C4.0.0|\u003E=4.0.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.56|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.50|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 10:45:07","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/serializer\/CVE-2026-118515.yaml"}]}],"symfony\/config":[{"advisoryId":"PKSA-9myg-zzdn-22rg","packageName":"symfony\/config","remoteId":"symfony\/config\/2026-11-04-1.yaml","title":"XXE (Local File Read) in Config XmlUtils::parse() via validateOnParse = true","link":"https:\/\/github.com\/symfony\/symfony\/security\/advisories\/GHSA-5jff-8h8q-r5qx","cve":null,"affectedVersions":"\u003E=2.0.0,\u003C3.0.0|\u003E=3.0.0,\u003C4.0.0|\u003E=4.0.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.56|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.50|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/config\/2026-11-04-1.yaml"}]}],"symfony\/json-path":[{"advisoryId":"PKSA-ptx6-hh9r-87bn","packageName":"symfony\/json-path","remoteId":"symfony\/json-path\/2026-11-04-20.yaml","title":"Incomplete Fix for CVE-2026-45756: JsonPath Queries Can Still Hold a Process Through search(), match() and Chained Filters","link":"https:\/\/github.com\/symfony\/symfony\/security\/advisories\/GHSA-cpww-5vpx-72x7","cve":null,"affectedVersions":"\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/json-path\/2026-11-04-20.yaml"}]}],"symfony\/html-sanitizer":[{"advisoryId":"PKSA-wwnc-rwy3-v11m","packageName":"symfony\/html-sanitizer","remoteId":"symfony\/html-sanitizer\/2026-11-04-2.yaml","title":"HtmlSanitizer Does Not URL-Sanitize srcset and imagesrcset: Media Scheme and Host Allow-List Bypass","link":"https:\/\/github.com\/symfony\/symfony\/security\/advisories\/GHSA-q8jq-xrf4-v5j8","cve":null,"affectedVersions":"\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.50|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/html-sanitizer\/2026-11-04-2.yaml"}]},{"advisoryId":"PKSA-4z5q-y2w8-bwqq","packageName":"symfony\/html-sanitizer","remoteId":"symfony\/html-sanitizer\/2026-11-04-3.yaml","title":"HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar: Incomplete Fix for CVE-2026-48761","link":"https:\/\/github.com\/symfony\/symfony\/security\/advisories\/GHSA-wm2w-4mgj-vw33","cve":null,"affectedVersions":"\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.50|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/html-sanitizer\/2026-11-04-3.yaml"}]},{"advisoryId":"PKSA-n87g-t5cn-m1yq","packageName":"symfony\/html-sanitizer","remoteId":"symfony\/html-sanitizer\/CVE-2026-118517.yaml","title":"CVE-2026-118517: HtmlSanitizer allowLinkHosts() \/ allowMediaHosts() Bypass via URLs Without a Well-Formed Authority: Incomplete Fix for CVE-2026-45066","link":"https:\/\/symfony.com\/cve-2026-118517","cve":"CVE-2026-118517","affectedVersions":"\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.50|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.23|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.11","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-04 11:23:22","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/html-sanitizer\/CVE-2026-118517.yaml"}]}],"symbiote\/silverstripe-advancedworkflow":[{"advisoryId":"PKSA-ts6y-cm2s-m66j","packageName":"symbiote\/silverstripe-advancedworkflow","remoteId":"symbiote\/silverstripe-advancedworkflow\/CVE-2026-88990.yaml","title":"CVE-2026-88990 - RCE in email template field via template execution","link":"https:\/\/www.silverstripe.org\/download\/security-releases\/cve-2026-88990","cve":"CVE-2026-88990","affectedVersions":"\u003C6.4.6|\u003E=7.0.0,\u003C7.2.4","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-28 01:49:43","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symbiote\/silverstripe-advancedworkflow\/CVE-2026-88990.yaml"}]},{"advisoryId":"PKSA-mv3b-jr11-x5qf","packageName":"symbiote\/silverstripe-advancedworkflow","remoteId":"symbiote\/silverstripe-advancedworkflow\/SS-2026-007.yaml","title":"SS-2026-007 - RCE via template string escaping in advanced workflow email template","link":"https:\/\/www.silverstripe.org\/download\/security-releases\/ss-2026-007","cve":null,"affectedVersions":"\u003C6.4.6|\u003E=7.0.0,\u003C7.2.4","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-28 01:49:43","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symbiote\/silverstripe-advancedworkflow\/SS-2026-007.yaml"}]},{"advisoryId":"PKSA-6bs9-m3c2-gy1z","packageName":"symbiote\/silverstripe-advancedworkflow","remoteId":"symbiote\/silverstripe-advancedworkflow\/SS-2026-002.yaml","title":"SS-2026-002 - Template injection RCE in advanced workflow","link":"https:\/\/www.silverstripe.org\/download\/security-releases\/ss-2026-002","cve":null,"affectedVersions":"\u003C6.4.6|\u003E=7.0.0,\u003C7.2.4","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-28 01:49:43","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symbiote\/silverstripe-advancedworkflow\/SS-2026-002.yaml"}]}],"silverstripe\/framework":[{"advisoryId":"PKSA-mxm6-h6dq-vmtc","packageName":"silverstripe\/framework","remoteId":"silverstripe\/framework\/CVE-2026-91110.yaml","title":"CVE-2026-91110 - XSS using control bytes","link":"https:\/\/www.silverstripe.org\/download\/security-releases\/cve-2026-91110","cve":"CVE-2026-91110","affectedVersions":"\u003C6.2.13","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-28 01:56:26","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"silverstripe\/framework\/CVE-2026-91110.yaml"}]},{"advisoryId":"PKSA-v91s-x13r-xsps","packageName":"silverstripe\/framework","remoteId":"silverstripe\/framework\/CVE-2026-88988.yaml","title":"CVE-2026-88988 - XSS via SVG data URI","link":"https:\/\/www.silverstripe.org\/download\/security-releases\/cve-2026-88988","cve":"CVE-2026-88988","affectedVersions":"\u003C6.2.13","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-28 01:56:26","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"silverstripe\/framework\/CVE-2026-88988.yaml"}]},{"advisoryId":"PKSA-byd1-vwr7-j3ng","packageName":"silverstripe\/framework","remoteId":"silverstripe\/framework\/CVE-2026-88989.yaml","title":"CVE-2026-88989 - Auth bypass GridFieldDetailForm","link":"https:\/\/www.silverstripe.org\/download\/security-releases\/cve-2026-88989","cve":"CVE-2026-88989","affectedVersions":"\u003C6.2.13","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-28 01:56:26","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"silverstripe\/framework\/CVE-2026-88989.yaml"}]},{"advisoryId":"PKSA-bqyr-kn4k-vx5h","packageName":"silverstripe\/framework","remoteId":"silverstripe\/framework\/CVE-2026-91115.yaml","title":"CVE-2026-91115 - RCE via i18nTextCollectorTask writer parameter","link":"https:\/\/www.silverstripe.org\/download\/security-releases\/cve-2026-91115","cve":"CVE-2026-91115","affectedVersions":"\u003E=6.0.0,\u003C6.2.13","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-28 01:56:26","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"silverstripe\/framework\/CVE-2026-91115.yaml"}]},{"advisoryId":"PKSA-2w11-jnmw-7vn5","packageName":"silverstripe\/framework","remoteId":"silverstripe\/framework\/CVE-2026-91114.yaml","title":"CVE-2026-91114 - Stored XSS via unescaped permission in PermissionCheckboxSetField","link":"https:\/\/www.silverstripe.org\/download\/security-releases\/cve-2026-91114","cve":"CVE-2026-91114","affectedVersions":"\u003C6.2.13","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-28 01:56:26","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"silverstripe\/framework\/CVE-2026-91114.yaml"}]},{"advisoryId":"PKSA-2h3f-jtk1-8f25","packageName":"silverstripe\/framework","remoteId":"silverstripe\/framework\/CVE-2026-91113.yaml","title":"CVE-2026-91113 - User-controlled ClassName allows unauthorized record type change","link":"https:\/\/www.silverstripe.org\/download\/security-releases\/cve-2026-91113","cve":"CVE-2026-91113","affectedVersions":"\u003C6.2.13","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-28 01:56:26","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"silverstripe\/framework\/CVE-2026-91113.yaml"}]},{"advisoryId":"PKSA-r36n-y55f-yj29","packageName":"silverstripe\/framework","remoteId":"silverstripe\/framework\/CVE-2026-91112.yaml","title":"CVE-2026-91112 - CMS_ACCESS_SecurityAdmin privilege escalation","link":"https:\/\/www.silverstripe.org\/download\/security-releases\/cve-2026-91112","cve":"CVE-2026-91112","affectedVersions":"\u003C6.2.13","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-28 01:56:26","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"silverstripe\/framework\/CVE-2026-91112.yaml"}]},{"advisoryId":"PKSA-3ddc-hhgt-bqh9","packageName":"silverstripe\/framework","remoteId":"silverstripe\/framework\/CVE-2026-88987.yaml","title":"CVE-2026-88987 - XSS via XHTML data URI","link":"https:\/\/www.silverstripe.org\/download\/security-releases\/cve-2026-88987","cve":"CVE-2026-88987","affectedVersions":"\u003C6.2.13","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-28 01:56:26","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"silverstripe\/framework\/CVE-2026-88987.yaml"}]},{"advisoryId":"PKSA-s9ft-gn8c-nz8s","packageName":"silverstripe\/framework","remoteId":"silverstripe\/framework\/SS-2026-004.yaml","title":"SS-2026-004 - Password reset token account takeover","link":"https:\/\/www.silverstripe.org\/download\/security-releases\/ss-2026-004","cve":null,"affectedVersions":"\u003C6.2.13","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-28 01:56:26","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"silverstripe\/framework\/SS-2026-004.yaml"}]}],"silverstripe\/assets":[{"advisoryId":"PKSA-gm8m-6kzj-72zw","packageName":"silverstripe\/assets","remoteId":"silverstripe\/assets\/SS-2026-003.yaml","title":"SS-2026-003 - RCE via renamed uploaded file","link":"https:\/\/www.silverstripe.org\/download\/security-releases\/ss-2026-003","cve":null,"affectedVersions":"\u003C2.4.6|\u003E=3.0.0,\u003C3.2.4","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-28 01:47:13","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"silverstripe\/assets\/SS-2026-003.yaml"}]}],"silverstripe\/userforms":[{"advisoryId":"PKSA-761z-bpk5-k27d","packageName":"silverstripe\/userforms","remoteId":"silverstripe\/userforms\/SS-2026-006.yaml","title":"SS-2026-006 - RCE via template string escaping in userforms email subject","link":"https:\/\/www.silverstripe.org\/download\/security-releases\/ss-2026-006","cve":null,"affectedVersions":"\u003C6.4.10|\u003E=7.0.0,\u003C7.1.4","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-28 02:02:02","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"silverstripe\/userforms\/SS-2026-006.yaml"}]},{"advisoryId":"PKSA-r5k2-9jwp-nhhh","packageName":"silverstripe\/userforms","remoteId":"silverstripe\/userforms\/SS-2026-005.yaml","title":"SS-2026-005 - XSS in required field label","link":"https:\/\/www.silverstripe.org\/download\/security-releases\/ss-2026-005","cve":null,"affectedVersions":"\u003C7.1.4","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-28 02:02:02","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"silverstripe\/userforms\/SS-2026-005.yaml"}]},{"advisoryId":"PKSA-838n-c32y-m854","packageName":"silverstripe\/userforms","remoteId":"silverstripe\/userforms\/SS-2026-001.yaml","title":"SS-2026-001 - Template injection RCE in userforms","link":"https:\/\/www.silverstripe.org\/download\/security-releases\/ss-2026-001","cve":null,"affectedVersions":"\u003C6.4.10|\u003E=7.0.0,\u003C7.1.4","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-28 02:02:02","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"silverstripe\/userforms\/SS-2026-001.yaml"}]},{"advisoryId":"PKSA-vyds-y4jb-5ff4","packageName":"silverstripe\/userforms","remoteId":"silverstripe\/userforms\/CVE-2026-91111.yaml","title":"CVE-2026-91111 - Uploaded XML XSS","link":"https:\/\/www.silverstripe.org\/download\/security-releases\/cve-2026-91111","cve":"CVE-2026-91111","affectedVersions":"\u003C7.1.4","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-28 02:02:02","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"silverstripe\/userforms\/CVE-2026-91111.yaml"}]},{"advisoryId":"PKSA-w1yx-v3g8-nw8g","packageName":"silverstripe\/userforms","remoteId":"silverstripe\/userforms\/CVE-2026-88992.yaml","title":"CVE-2026-88992 - Userforms CSV export restricted file access","link":"https:\/\/www.silverstripe.org\/download\/security-releases\/cve-2026-88992","cve":"CVE-2026-88992","affectedVersions":"\u003C7.1.4","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-28 02:02:02","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"silverstripe\/userforms\/CVE-2026-88992.yaml"}]},{"advisoryId":"PKSA-kp8m-vvtz-69sm","packageName":"silverstripe\/userforms","remoteId":"silverstripe\/userforms\/CVE-2026-88991.yaml","title":"CVE-2026-88991 - RCE in email subject field via template execution","link":"https:\/\/www.silverstripe.org\/download\/security-releases\/cve-2026-88991","cve":"CVE-2026-88991","affectedVersions":"\u003C6.4.10|\u003E=7.0.0,\u003C7.1.4","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-28 02:02:02","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"silverstripe\/userforms\/CVE-2026-88991.yaml"}]}],"mediaessenz\/mail":[{"advisoryId":"PKSA-b657-vnvm-qnk7","packageName":"mediaessenz\/mail","remoteId":"mediaessenz\/mail\/CVE-2026-120328.yaml","title":"TYPO3-EXT-SA-2026-037: Information Disclosure in extension \u0022Mail\u0022 (mail)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-037","cve":"CVE-2026-120328","affectedVersions":"\u003E=4.0.0,\u003C4.2.0|\u003C3.12.5","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-03 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"mediaessenz\/mail\/CVE-2026-120328.yaml"}]},{"advisoryId":"PKSA-t76y-hqn1-zzxw","packageName":"mediaessenz\/mail","remoteId":"mediaessenz\/mail\/CVE-2026-120332.yaml","title":"TYPO3-EXT-SA-2026-037: Cross-Site Scripting in extension \u0022Mail\u0022 (mail)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-037","cve":"CVE-2026-120332","affectedVersions":"\u003E=4.0.0,\u003C4.2.0|\u003C3.12.5","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-03 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"mediaessenz\/mail\/CVE-2026-120332.yaml"}]},{"advisoryId":"PKSA-833v-cnnh-wds7","packageName":"mediaessenz\/mail","remoteId":"mediaessenz\/mail\/CVE-2026-120330.yaml","title":"TYPO3-EXT-SA-2026-037: Broken Access Control in extension \u0022Mail\u0022 (mail)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-037","cve":"CVE-2026-120330","affectedVersions":"\u003E=4.0.0,\u003C4.2.0|\u003C3.12.5","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-03 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"mediaessenz\/mail\/CVE-2026-120330.yaml"}]},{"advisoryId":"PKSA-spg7-jb73-vpnk","packageName":"mediaessenz\/mail","remoteId":"mediaessenz\/mail\/CVE-2026-120331.yaml","title":"TYPO3-EXT-SA-2026-037: Server-Side Request Forgery in extension \u0022Mail\u0022 (mail)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-037","cve":"CVE-2026-120331","affectedVersions":"\u003E=4.0.0,\u003C4.2.0|\u003C3.12.5","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-03 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"mediaessenz\/mail\/CVE-2026-120331.yaml"}]},{"advisoryId":"PKSA-p6j1-yhwr-yntb","packageName":"mediaessenz\/mail","remoteId":"mediaessenz\/mail\/CVE-2026-120329.yaml","title":"TYPO3-EXT-SA-2026-037: Broken Access Control in extension \u0022Mail\u0022 (mail)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-037","cve":"CVE-2026-120329","affectedVersions":"\u003E=4.0.0,\u003C4.2.0|\u003C3.12.5","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-03 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"mediaessenz\/mail\/CVE-2026-120329.yaml"}]},{"advisoryId":"PKSA-b2p7-6qcf-92nb","packageName":"mediaessenz\/mail","remoteId":"mediaessenz\/mail\/CVE-2026-120327.yaml","title":"TYPO3-EXT-SA-2026-037: Open Redirection in extension \u0022Mail\u0022 (mail)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-037","cve":"CVE-2026-120327","affectedVersions":"\u003E=4.0.0,\u003C4.2.0|\u003C3.12.5","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-03 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"mediaessenz\/mail\/CVE-2026-120327.yaml"}]}],"evoweb\/sf-register":[{"advisoryId":"PKSA-d3w6-c3np-2vn6","packageName":"evoweb\/sf-register","remoteId":"evoweb\/sf-register\/CVE-2026-120333.yaml","title":"TYPO3-EXT-SA-2026-038: Broken Access Control in extension \u0022Frontend User Registration\u0022 (sf_register)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-038","cve":"CVE-2026-120333","affectedVersions":"\u003E=14.0.0,\u003C14.0.3|\u003C13.2.5","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-03 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"evoweb\/sf-register\/CVE-2026-120333.yaml"}]}],"doctrine\/mongodb-odm":[{"advisoryId":"PKSA-cknr-8ckg-k248","packageName":"doctrine\/mongodb-odm","remoteId":"doctrine\/mongodb-odm\/GHSA-cr6x-45gj-q6f5.yaml","title":"EncryptedFieldsMapGenerator may silently omit encrypted fields when a document has embedded documents","link":"https:\/\/github.com\/doctrine\/mongodb-odm\/security\/advisories\/GHSA-cr6x-45gj-q6f5","cve":null,"affectedVersions":"\u003E=2.12.0,\u003C2.17.3","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-11-03 05:21:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"doctrine\/mongodb-odm\/GHSA-cr6x-45gj-q6f5.yaml"}]}],"silverstripe\/mfa":[{"advisoryId":"PKSA-xxk3-rjxm-jftv","packageName":"silverstripe\/mfa","remoteId":"silverstripe\/mfa\/CVE-2026-55186.yaml","title":"CVE-2026-55186 - Can bypass MFA during password reset flow","link":"https:\/\/www.silverstripe.org\/download\/security-releases\/cve-2026-55186","cve":"CVE-2026-55186","affectedVersions":"\u003C6.0.0","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-01-01 00:00:00","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-68wq-phq7-p2vg"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"silverstripe\/mfa\/CVE-2026-55186.yaml"}]}],"dolibarr\/dolibarr":[{"advisoryId":"PKSA-w1dm-r75t-7cq5","packageName":"dolibarr\/dolibarr","remoteId":"GHSA-v5fq-cf5m-vwv7","title":"Dolibarr has SQL Injection in societe\/class\/societe.class.php via localtax1_value parameter","link":"https:\/\/github.com\/advisories\/GHSA-v5fq-cf5m-vwv7","cve":"CVE-2026-33944","affectedVersions":"\u003E=23.0.0,\u003C23.0.2|\u003C22.0.5","source":"GitHub","reportedAt":"2026-10-27 13:29:25","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-v5fq-cf5m-vwv7"}]}],"facturascripts\/facturascripts":[{"advisoryId":"PKSA-ckhc-1b7w-fbqb","packageName":"facturascripts\/facturascripts","remoteId":"GHSA-hgjx-r89m-m7v4","title":"FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() \u2014 arbitrary file write outside MyFiles\/ leading to   RCE","link":"https:\/\/github.com\/advisories\/GHSA-hgjx-r89m-m7v4","cve":"CVE-2026-77526","affectedVersions":"\u003E=2025,\u003C=2026.2","source":"GitHub","reportedAt":"2026-07-14 20:52:00","composerRepository":"https:\/\/packagist.org","severity":"critical","sources":[{"name":"GitHub","remoteId":"GHSA-hgjx-r89m-m7v4"}]}]}}