https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 07:40:51 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0617 certfr-2026-avi-0617 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0617 https://cve.radiocsirt.org/vuln/euvd-2026-339249 EUVD-2026-339249 https://cve.radiocsirt.org/vuln/euvd-2026-339249 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45754 <p>Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, the Mailjet mailer bridge and LOX24 notifier bridge webhook parsers received configured webhook secrets but did not verify them, allowing unauthenticated POST requests to inject forged Mailjet and LOX24 event payloads. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.</p> <p>Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, the Mailjet mailer bridge and LOX24 notifier bridge webhook parsers received configured webhook secrets but did not verify them, allowing unauthenticated POST requests to inject forged Mailjet and LOX24 event payloads. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-45754 https://cve.radiocsirt.org/vuln/ghsa-64hg-93w9-fc35 <p><strong>Affected:</strong> Packagist: symfony/lox24-notifier, Packagist: symfony/symfony, Packagist: symfony/mailjet-mailer</p> <p>### Description</p> <p>The Mailjet mailer bridge and the LOX24 SMS notifier bridge both ship webhook request parsers used to authenticate and decode the event callbacks each provider POSTs to an application&#39;s webhook endpoint. Their `doParse(Request $request, #[\SensitiveParameter] string $secret)` methods receive the configured webhook secret but never read it; they convert and return the payload unconditionally.</p> <p>As a result, an application that wires up either webhook endpoint accepts **any** POST to that URL, even when a webhook secret is configured (the recommended setup). An attacker who knows the endpoint exists can submit forged event payloads, fake bounce / blocked / spam / open / click / delivery events, leading to suppression-list corruption, delivery-metrics fraud, etc.</p> <p>### Resolution</p> <p>`MailjetRequestParser::doParse()` now rejects the request unless it carries the expected HTTP Basic credentials, Mailjet&#39;s webhook authentication mechanism, using a constant-time comparison. The configured webhook secret is matched against the credentials embedded in the Mailjet webhook URL as `user:password` (use `:password` when the URL has no username).</p> <p>`Lox24RequestParser::doParse()` now rejects the request unless it carries an `X-LOX24-Token` HTTP header whose value matches the configured secret, using a constant-time comparison. The same token must be configured in the LOX24 dashboard under the callback settings.</p> <p>When no secret is configured the behaviour is unchanged: webhook a…</p> <p><strong>Affected:</strong> Packagist: symfony/lox24-notifier, Packagist: symfony/symfony, Packagist: symfony/mailjet-mailer</p> <p>### Description</p> <p>The Mailjet mailer bridge and the LOX24 SMS notifier bridge both ship webhook request parsers used to authenticate and decode the event callbacks each provider POSTs to an application&#39;s webhook endpoint. Their `doParse(Request $request, #[\SensitiveParameter] string $secret)` methods receive the configured webhook secret but never read it; they convert and return the payload unconditionally.</p> <p>As a result, an application that wires up either webhook endpoint accepts **any** POST to that URL, even when a webhook secret is configured (the recommended setup). An attacker who knows the endpoint exists can submit forged event payloads, fake bounce / blocked / spam / open / click / delivery events, leading to suppression-list corruption, delivery-metrics fraud, etc.</p> <p>### Resolution</p> <p>`MailjetRequestParser::doParse()` now rejects the request unless it carries the expected HTTP Basic credentials, Mailjet&#39;s webhook authentication mechanism, using a constant-time comparison. The configured webhook secret is matched against the credentials embedded in the Mailjet webhook URL as `user:password` (use `:password` when the URL has no username).</p> <p>`Lox24RequestParser::doParse()` now rejects the request unless it carries an `X-LOX24-Token` HTTP header whose value matches the configured secret, using a constant-time comparison. The same token must be configured in the LOX24 dashboard under the callback settings.</p> <p>When no secret is configured the behaviour is unchanged: webhook a…</p> https://cve.radiocsirt.org/vuln/ghsa-64hg-93w9-fc35 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-45754 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: symfony, Ubuntu:Pro:18.04:LTS: symfony, Ubuntu:Pro:20.04:LTS: symfony, Ubuntu:Pro:22.04:LTS: symfony, Ubuntu:Pro:24.04:LTS: symfony, Ubuntu:25.10: symfony, Ubuntu:26.04:LTS: symfony</p> <p>Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, the Mailjet mailer bridge and LOX24 notifier bridge webhook parsers received configured webhook secrets but did not verify them, allowing unauthenticated POST requests to inject forged Mailjet and LOX24 event payloads. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: symfony, Ubuntu:Pro:18.04:LTS: symfony, Ubuntu:Pro:20.04:LTS: symfony, Ubuntu:Pro:22.04:LTS: symfony, Ubuntu:Pro:24.04:LTS: symfony, Ubuntu:25.10: symfony, Ubuntu:26.04:LTS: symfony</p> <p>Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, the Mailjet mailer bridge and LOX24 notifier bridge webhook parsers received configured webhook secrets but did not verify them, allowing unauthenticated POST requests to inject forged Mailjet and LOX24 event payloads. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-45754