CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 29, 2026, 5:50 AM ET)

What this means for you

This week: 3,087 CVEs published, 232 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,087; Show in the list
Critical, last 7 days: 232; Show in the list
Healthcare-tagged, last 7 days: 9; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product symfony:symfony. Show all products

31 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2026-48761	Medium 5.3	Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> content Assigned by GitHub_M	Jul 14, 2026
CVE-2026-48747	Medium 6.3	Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade Assigned by GitHub_M	Jul 14, 2026
CVE-2026-48489	High 8.7	Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes Assigned by GitHub_M	Jul 14, 2026
CVE-2026-48760	Medium 5.3	Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense Assigned by GitHub_M	Jul 14, 2026
CVE-2026-48736	Medium 6.9	Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient Assigned by GitHub_M	Jul 14, 2026
CVE-2026-48784	Medium 5.1	Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization Assigned by GitHub_M	Jul 14, 2026
CVE-2026-45068	High 8.7	Symfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address Assigned by GitHub_M	Jul 14, 2026
CVE-2026-47212	Medium 6.9	Symfony: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event Injection Assigned by GitHub_M	Jul 14, 2026
CVE-2026-45071	High 8.7	Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true Assigned by GitHub_M	Jul 14, 2026
CVE-2026-45755	Medium 6.9	Symfony: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection Assigned by GitHub_M	Jul 14, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.