How many symfony html-sanitizer CVEs are in CISA KEV?

None of symfony html-sanitizer's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which versions of symfony html-sanitizer are affected?

6 distinct symfony html-sanitizer versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in symfony html-sanitizer CVEs?

symfony html-sanitizer's CVEs most often map to these CWE weakness types: CWE-451 (User Interface (UI) Misrepresentation of Critical Information), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-184 (Incomplete List of Disallowed Inputs).

What is the average severity of symfony html-sanitizer CVEs?

The average CVSS base score across symfony html-sanitizer's scored CVEs is 4.4.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

symfony

5 CVEs

symfony html-sanitizer Vulnerabilities

Name: symfony html-sanitizer vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for html-sanitizer by symfony.

5

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

0

Public exploits

PoC or exploit code

4.4

Avg CVSS

2026–2026

Last updated July 14, 2026

Overview

symfony html-sanitizer has 5 published CVE records since 2026, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 0 have a known public exploit. The average CVSS base score across scored CVEs is 4.4.

This page aggregates every publicly disclosed vulnerability (CVE) affecting symfony html-sanitizer, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of symfony html-sanitizer's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical0

High0

Medium3

Low2

In CISA’s Known Exploited Vulnerabilities catalog

0

None of symfony html-sanitizer's CVEs are currently listed in CISA's KEV catalog.

Public exploits

0

No symfony html-sanitizer CVEs currently have a tracked public exploit.

Affected versions and CVEs

Browse every symfony html-sanitizer version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

>= 6.1.0-BETA1, < 6.4.403 CVEs
>= 7.0.0-BETA1, < 7.4.123 CVEs
>= 8.0.0-BETA1, < 8.0.123 CVEs
>= 6.1.0, < 6.4.412 CVEs
>= 7.0.0-BETA1, < 7.4.132 CVEs
>= 8.0.0-BETA1, < 8.0.132 CVEs

Find a version

5 CVEs

Sort

Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on , , , and the URL Inside content
CVE-2026-48761
Patch
CWE-79
Medium · CVSS 5.3
EPSS 0.3% (19th pct)2026-07-14
Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense
CVE-2026-48760
Patch
CWE-451
Medium · CVSS 5.3
EPSS 0.3% (18th pct)2026-07-14
Symfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing
CVE-2026-45064
Patch
CWE-451
Medium · CVSS 6.9
EPSS 0.3% (22th pct)2026-07-14
Symfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS)
CVE-2026-45753
Patch
CWE-79
Low · CVSS 2.1
EPSS 0.3% (22th pct)2026-07-14
Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and Misclassification
CVE-2026-45066
Patch
CWE-184
Low · CVSS 2.3
EPSS 0.3% (22th pct)2026-07-14

Common weakness types

The CWE weakness categories most often found in symfony html-sanitizer CVEs. Follow any weakness for its full explanation.

Other symfony products

Browse vulnerabilities for other products by symfony.

symfony/symfony94 CVEs symfony84 CVEs twig25 CVEs symfony/security-http19 CVEs symfony/security17 CVEs symfony/http-foundation13 CVEs security-http11 CVEs ux10 CVEs

All symfony vulnerabilities

Frequently asked questions

Common questions about symfony html-sanitizer vulnerabilities.

How many CVEs does symfony html-sanitizer have?: symfony html-sanitizer has 5 published CVE records since 2026.
How many symfony html-sanitizer CVEs are in CISA KEV?: None of symfony html-sanitizer's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for symfony html-sanitizer vulnerabilities?: No symfony html-sanitizer CVEs currently have a tracked public exploit in this dataset.
Which versions of symfony html-sanitizer are affected?: 6 distinct symfony html-sanitizer versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in symfony html-sanitizer CVEs?: symfony html-sanitizer's CVEs most often map to these CWE weakness types: CWE-451 (User Interface (UI) Misrepresentation of Critical Information), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-184 (Incomplete List of Disallowed Inputs).
What is the average severity of symfony html-sanitizer CVEs?: The average CVSS base score across symfony html-sanitizer's scored CVEs is 4.4.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track symfony html-sanitizer vulnerabilities

Monitor new symfony html-sanitizer vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing