--- title: "symfony ux vulnerabilities and CVEs" url: https://radicalnotion.ai/vendor/symfony/ux type: product description: "symfony ux has 10 published CVEs, 0 in CISA KEV and 0 with public exploits." updated: 2026-07-17 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # symfony ux vulnerabilities Vendor: [symfony](https://radicalnotion.ai/vendor/symfony) - **Published CVEs:** 10 - **In CISA KEV:** 0 - **With a public exploit:** 0 - **With a patch:** 10 - **Average CVSS:** 5.8 - **First CVE:** 2025-05-19 - **Latest CVE:** 2026-07-17 ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 0 | | High | 1 | | Medium | 8 | | Low | 1 | | Unscored | 0 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 4 | | [CWE-200](https://radicalnotion.ai/cwe/cwe-200) | Exposure of Sensitive Information to an Unauthorized Actor | 1 | | [CWE-22](https://radicalnotion.ai/cwe/cwe-22) | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 1 | | [CWE-20](https://radicalnotion.ai/cwe/cwe-20) | Improper Input Validation | 1 | | [CWE-352](https://radicalnotion.ai/cwe/cwe-352) | Cross-Site Request Forgery (CSRF) | 1 | | [CWE-770](https://radicalnotion.ai/cwe/cwe-770) | Allocation of Resources Without Limits or Throttling | 1 | | [CWE-345](https://radicalnotion.ai/cwe/cwe-345) | Insufficient Verification of Data Authenticity | 1 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2025 | 1 | | 2026 | 9 | ## Affected versions (top 23 of 88) | Version | Kind | CVEs | | --- | --- | --- | | 2.22.0 | exact | 9 | | 2.22.1 | exact | 9 | | 2.23.0 | exact | 9 | | 2.24.0 | exact | 9 | | 2.25.0 | exact | 9 | | 2.32.0 | exact | 9 | | 2.33.0 | exact | 9 | | 2.34.0 | exact | 9 | | 2.35.0 | exact | 9 | | 3.0.0 | exact | 9 | | 2.17.0 | exact | 8 | | 2.18.0 | exact | 8 | | 3.0.0 | range | 7 | | 2.8.0 \<= v \< 2.36.0 | range | 3 | | 2.2.0 \<= v \< 2.36.0 | range | 2 | | \< 2.25.1 | range | 1 | | 2.17.0 \<= v \< 2.36.1 | range | 1 | | 2.22.0 \<= v \< 2.36.0 | range | 1 | | 2.5.0 \<= v \< 2.36.0 | range | 1 | | 3.0.0 \<= v \< 3.2.0 | range | 1 | | 2.36.0 | patched | 7 | | 2.36.1 | patched | 1 | | 3.2.0 | patched | 1 | ## CVEs | CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch | | --- | --- | --- | --- | --- | --- | --- | | CVE-2026-49215 | Symfony UX: CSRF Protection Bypass in symfony/ux-live-component — Accept Header is CORS-Safelisted | low | 2.1 | No | No | Yes | | CVE-2026-49216 | Symfony UX: XSS in symfony/ux-autocomplete via unescaped AJAX response data | medium | 5.1 | No | No | Yes | | CVE-2026-49211 | Symfony UX: Information exposure via unescaped LIKE wildcards in EntitySearchUtil | medium | 6.9 | No | No | Yes | | CVE-2026-49208 | Symfony UX: Format-less date LiveProps parsed with the permissive DateTime constructor | medium | 6.9 | No | No | Yes | | CVE-2026-49210 | Symfony UX: XSS in symfony/ux-live-component via attacker-controlled child component tag | medium | 5.1 | No | No | Yes | | CVE-2026-49212 | Symfony UX: LiveComponentHydrator HMAC checksum lacks component and slot binding | medium | 6.9 | No | No | Yes | | CVE-2026-49209 | Symfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requests | medium | 5.3 | No | No | Yes | | CVE-2026-55877 | Symfony UX: XSS in symfony/ux-icons via unsanitized SVG content in local files and Iconify on-demand responses | medium | 6.1 | No | No | Yes | | CVE-2026-55878 | Symfony: Path Traversal in symfony/ux-toolkit Allows Arbitrary File Write and Read via Crafted Recipe Manifest | high | 7.8 | No | No | Yes | | CVE-2025-47946 | symfony/ux-live-component and symfony/ux-twig-component vulnerable to unsanitized HTML attribute injection via ComponentAttributes | medium | 6.1 | No | No | Yes | ## Frequently asked questions ### How many CVEs does symfony ux have? symfony ux has 10 published CVE records since 2025. ### How many symfony ux CVEs are in CISA KEV? None of symfony ux's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog. ### Are there public exploits for symfony ux vulnerabilities? No symfony ux CVEs currently have a tracked public exploit in this dataset. ### Which versions of symfony ux are affected? 88 distinct symfony ux versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version. ### What are the most common weakness types in symfony ux CVEs? symfony ux's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-20 (Improper Input Validation). ### What is the average severity of symfony ux CVEs? The average CVSS base score across symfony ux's scored CVEs is 5.8. ## Other products from this vendor - [symfony](https://radicalnotion.ai/vendor/symfony/symfony) (115 CVEs) - [symfony/symfony](https://radicalnotion.ai/vendor/symfony/symfony-symfony) (96 CVEs) - [twig](https://radicalnotion.ai/vendor/symfony/twig) (25 CVEs) - [symfony/security-http](https://radicalnotion.ai/vendor/symfony/symfony-security-http) (19 CVEs) - [symfony/security](https://radicalnotion.ai/vendor/symfony/symfony-security) (17 CVEs) - [symfony/http-foundation](https://radicalnotion.ai/vendor/symfony/symfony-http-foundation) (14 CVEs) - [security-http](https://radicalnotion.ai/vendor/symfony/security-http) (11 CVEs) - [symfony/http-kernel](https://radicalnotion.ai/vendor/symfony/symfony-http-kernel) (8 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/symfony/ux). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.