https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T23:29:46.636399+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2023-avi-0930 certfr-2023-avi-0930 — De multiples vulnérabilités ont été découvertes dans<span class="textit"> Symfony</span>. Elles permettent à un attaqua… 2026-10-05T23:29:46.720931+00:00 certfr-2023-avi-0930 https://cve.radiocsirt.org/vuln/euvd-2026-161064 EUVD-2026-161064 2026-10-05T23:29:46.720972+00:00 EUVD-2026-161064 https://cve.radiocsirt.org/vuln/fkie_cve-2023-46735 fkie_cve-2023-46735 2026-10-05T23:29:46.720988+00:00

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in version 6.0.0 and prior to version 6.3.8, the error message in `WebhookController` returns unescaped user-submitted input. As of version 6.3.8, `WebhookController` now doesn't return any user-submitted input in its response.

 https://cve.radiocsirt.org/vuln/ghsa-72x2-5c85-6wmr GHSA-72x2-5c85-6wmr — Symfony potential Cross-site Scripting in WebhookController 2026-10-05T23:29:46.721019+00:00

Affected: Packagist: symfony/webhook, Packagist: symfony/symfony

### Description

The error message in WebhookController returns unescaped user-submitted input.

### Resolution

WebhookController now doesn't return any user-submitted input in its response.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/8128c302430394f639e818a7103b3f6815d8d962) for branch 6.3.

### Credits

We would like to thank Maxime Aknin for reporting the issue and to Nicolas Grekas for providing the fix.

 https://cve.radiocsirt.org/vuln/gsd-2023-46735 gsd-2023-46735 2026-10-05T23:29:46.721050+00:00 gsd-2023-46735 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-46735 Withdrawn: UBUNTU-CVE-2023-46735 2026-10-05T23:29:46.721062+00:00

Withdrawn by the publisher.

Affected: Ubuntu:Pro:16.04:LTS: symfony, Ubuntu:Pro:18.04:LTS: symfony, Ubuntu:20.04:LTS: symfony, Ubuntu:22.04:LTS: symfony, Ubuntu:24.10: symfony, Ubuntu:24.04:LTS: symfony

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in version 6.0.0 and prior to version 6.3.8, the error message in `WebhookController` returns unescaped user-submitted input. As of version 6.3.8, `WebhookController` now doesn't return any user-submitted input in its response.