| [CVE-2026-48784] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, UrlGenerator::doGenerate() used strtr() dot-segment encod | Medium(5.1) | FixedDetails (4)6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13
|
| [CVE-2026-48761] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlAttributeSanitizer::getSupportedAttributes() omitted U | Medium(5.3) | FixedDetails (4)6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13
|
| [CVE-2026-48760] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlSanitizer::parse() rejected raw BiDi formatting charac | Medium(5.3) | FixedDetails (4)6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13
|
| [CVE-2026-48736] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.0 to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBN | Medium(6.9) | FixedDetails (4)6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13
|
| [CVE-2026-48489] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, DefaultAuthenticationFailureHandler honored the request-s | High(8.7) | FixedDetails (4)6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13
|
| [CVE-2026-47212] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, TwilioRequestParser::doParse() received the configured webhook se | Medium(6.9) | FixedDetails (4)6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13
|
| [CVE-2026-45071] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Crawler::addXmlContent() set DOMDocument::$validateOnPars | High(8.7) | FixedDetails (4)6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13
|
| [CVE-2026-45068] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, SendmailTransport in -t mode appended recipient addresses | High(8.7) | FixedDetails (4)6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13
|
| [CVE-2026-47767] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.46 until 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the CVE-2024-50340 fix gated runtime argv parsin | High(8.3) | FixedDetails (4)6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13
|
| [CVE-2026-45754] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, the Mailjet mailer bridge and LOX24 notifier bridge webhook parse | Medium(6.9) | FixedDetails (4)6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13
|
| [CVE-2026-45753] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlAttributeSanitizer::getSupportedAttributes() omi | Low(2.1) | FixedDetails (4)6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13
|
| [CVE-2026-45073] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, PdoAdapter::doClear() builds a DELETE statement using a n | Medium(6.3) | FixedDetails (4)6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13
|
| [CVE-2026-45072] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.4.24 until 6.4.40, 7.4.12, and 8.0.12, the development profiler file_excerpt Twig filter escape | Low(2) | FixedDetails (4)6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13
|
| [CVE-2026-45070] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Mime\Header\ParameterizedHeader validat | Medium(6.3) | FixedDetails (4)6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13
|
| [CVE-2026-45069] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, OidcTokenHandler::verifyClaims() registered audience (aud), issue | High(8.8) | FixedDetails (4)6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13
|
| [CVE-2026-45064] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlSanitizer::parse() passes Unicode explicit-direc | Low(2.3) | FixedDetails (4)6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13
|
| [CVE-2026-45063] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, X509Authenticator extracts the user identifier from $_SER | Critical(9.1) | FixedDetails (4)6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13 6.4.41+dfsg-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.4.41+dfsg-0+deb13u1 nvd · symfony · debian · 13
|