https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T16:31:49.825505+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2023-08237 bdu:2023-08237 2026-10-03T16:31:49.935177+00:00 bdu:2023-08237 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0930 certfr-2023-avi-0930 — De multiples vulnérabilités ont été découvertes dans<span class="textit"> Symfony</span>. Elles permettent à un attaqua… 2026-10-03T16:31:49.935281+00:00 certfr-2023-avi-0930 https://cve.radiocsirt.org/vuln/euvd-2026-216919 EUVD-2026-216919 2026-10-03T16:31:49.935318+00:00 EUVD-2026-216919 https://cve.radiocsirt.org/vuln/fkie_cve-2023-46734 fkie_cve-2023-46734 2026-10-03T16:31:49.935356+00:00

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 2.0.0, 5.0.0, and 6.0.0 and prior to versions 4.4.51, 5.4.31, and 6.3.8, some Twig filters in CodeExtension use `is_safe=html` but don't actually ensure their input is safe. As of versions 4.4.51, 5.4.31, and 6.3.8, Symfony now escapes the output of the affected filters.

 https://cve.radiocsirt.org/vuln/ghsa-q847-2q57-wmr3 GHSA-q847-2q57-wmr3 — Symfony potential Cross-site Scripting vulnerabilities in CodeExtension filters 2026-10-03T16:31:49.935392+00:00

Affected: Packagist: symfony/twig-bridge, Packagist: symfony/symfony

### Description

Some Twig filters in CodeExtension use "is_safe=html" but don't actually ensure their input is safe.

### Resolution

Symfony now escapes the output of the affected filters.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/9da9a145ce57e4585031ad4bee37c497353eec7c) for branch 4.4.

### Credits

We would like to thank Pierre Rudloff for reporting the issue and to Nicolas Grekas for providing the fix.

 https://cve.radiocsirt.org/vuln/gsd-2023-46734 gsd-2023-46734 2026-10-03T16:31:49.935429+00:00 gsd-2023-46734 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-46734 UBUNTU-CVE-2023-46734 2026-10-03T16:31:49.935442+00:00

Affected: Ubuntu:16.04:LTS: symfony, Ubuntu:Pro:18.04:LTS: symfony, Ubuntu:Pro:20.04:LTS: symfony, Ubuntu:Pro:22.04:LTS: symfony

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 2.0.0, 5.0.0, and 6.0.0 and prior to versions 4.4.51, 5.4.31, and 6.3.8, some Twig filters in CodeExtension use `is_safe=html` but don't actually ensure their input is safe. As of versions 4.4.51, 5.4.31, and 6.3.8, Symfony now escapes the output of the affected filters.