Login Request a demo
UX
Product
ux
by symfony · last CVE Jul 17, 2026
9
CVEs
0
On KEV
7.8
Max CVSS
0
New 30D
Vulnerabilities9In the news0Timeline
Severity mix
Critical 0High 3Medium 6Low 0
Severity
All severities9Critical0High3Medium6Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add ux to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-55878
7.8
0%
Jul 8
Symfony: Path Traversal in symfony/ux-toolkit Allows Arbitrary File Write and Read via Crafted Recipe Manifest
Affected: >= 2.32.0, < 2.36.1; >= 3.0.0, < 3.2.0
CVE-2026-49211
7.5
1%
Jul 17
Symfony UX: Information exposure via unescaped LIKE wildcards in EntitySearchUtil
Affected: >= 3.0.0, < 3.1.0; >= 2.2.0, < 2.36.0
CVE-2026-49212
7.5
0%
Jul 17
Symfony UX: LiveComponentHydrator HMAC checksum lacks component and slot binding
Affected: >= 3.0.0, < 3.1.0; < 2.36.0
CVE-2026-49209
6.5
1%
Jul 17
Symfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requests
Affected: >= 3.0.0, < 3.1.0; >= 2.5.0, < 2.36.0
CVE-2026-49210
6.1
0%
Jul 17
Symfony UX: XSS in symfony/ux-live-component via attacker-controlled child component tag
Affected: >= 3.0.0, < 3.1.0; >= 2.8.0, < 2.36.0
CVE-2026-55877
6.1
0%
Jul 8
Symfony UX: XSS in symfony/ux-icons via unsanitized SVG content in local files and Iconify on-demand responses
Affected: >= 2.17.0, < 2.36.1; >= 3.0.0, < 3.2.0
CVE-2026-49215
5.4
0%
Jul 17
Symfony UX: CSRF Protection Bypass in symfony/ux-live-component — Accept Header is CORS-Safelisted
Affected: >= 3.0.0, < 3.1.0; >= 2.22.0, < 2.36.0
CVE-2026-49216
5.4
0%
Jul 17
Symfony UX: XSS in symfony/ux-autocomplete via unescaped AJAX response data
Affected: >= 3.0.0, < 3.1.0; < 2.36.0
CVE-2026-49208
5.3
0%
Jul 17
Symfony UX: Format-less date LiveProps parsed with the permissive DateTime constructor
Affected: >= 3.0.0, < 3.1.0; >= 2.8.0, < 2.36.0
Showing 9