The "private_ranges" Trusted Proxies Shortcut Trusts Clients Presenting an IPv4-Mapped, 6to4, Teredo or NAT64 Address as Reverse Proxies
November 4, 2026
#Symfony
ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested Objects
November 4, 2026
#Symfony
XXE (Local File Read) in Config XmlUtils::parse() via validateOnParse = true
November 4, 2026
#Symfony
HtmlSanitizer Does Not URL-Sanitize srcset and imagesrcset: Media Scheme and Host Allow-List Bypass
November 4, 2026
#Symfony
HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar: Incomplete Fix for CVE-2026-48761
November 4, 2026
#Symfony
Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses: SSRF Filter Bypass
November 4, 2026
#Symfony
HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority: Incomplete Fix for CVE-2026-45066
November 4, 2026
#Symfony
Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control
November 4, 2026
#Symfony
👍 1
The Serializer Builds UploadedFile Objects From Request Data, Letting a Client Point an Upload at Any Server File
November 4, 2026
#Symfony
HEAD Requests Bypass the methods Option of security.access_control Rules and Firewalls: Incomplete Fix for CVE-2026-45075
November 4, 2026
#Symfony