https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 05:51:50 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0653 certfr-2026-avi-0653 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0653 https://cve.radiocsirt.org/vuln/euvd-2026-339253 EUVD-2026-339253 https://cve.radiocsirt.org/vuln/euvd-2026-339253 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48761 <p>Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlAttributeSanitizer::getSupportedAttributes() omitted URL-bearing attributes on &lt;object&gt;, &lt;applet&gt;, &lt;iframe&gt;, and &lt;img&gt;, and &lt;meta http-equiv=&#34;refresh&#34;&gt; URLs inside content bypassed URL sanitization, allowing explicitly enabled elements or attributes to pass javascript: and similar payloads into sanitized output. This issue is fixed in versions 6.4.41, 7.4.13, and 8.0.13.</p> <p>Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlAttributeSanitizer::getSupportedAttributes() omitted URL-bearing attributes on &lt;object&gt;, &lt;applet&gt;, &lt;iframe&gt;, and &lt;img&gt;, and &lt;meta http-equiv=&#34;refresh&#34;&gt; URLs inside content bypassed URL sanitization, allowing explicitly enabled elements or attributes to pass javascript: and similar payloads into sanitized output. This issue is fixed in versions 6.4.41, 7.4.13, and 8.0.13.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-48761 https://cve.radiocsirt.org/vuln/ghsa-x5qj-865h-mgvm <p><strong>Affected:</strong> Packagist: symfony/html-sanitizer, Packagist: symfony/symfony</p> <p>### Description</p> <p>`Symfony\Component\HtmlSanitizer\Visitor\AttributeSanitizer\UrlAttributeSanitizer::getSupportedAttributes()` enumerates the attribute names whose values are scrubbed through `UrlSanitizer::sanitize()` (scheme and host allow-lists, `javascript:` rejection, BiDi check, etc.). The list is `[&#39;src&#39;, &#39;href&#39;, &#39;lowsrc&#39;, &#39;background&#39;, &#39;ping&#39;, &#39;action&#39;, &#39;formaction&#39;, &#39;poster&#39;, &#39;cite&#39;]`. Other URL-bearing attributes are absent: `&lt;object data=…&gt;`, `&lt;applet codebase=…&gt;`, `&lt;applet archive=…&gt;` and `&lt;object archive=…&gt;`, `&lt;iframe longdesc=…&gt;` and `&lt;img longdesc=…&gt;`. When an integrator opts these elements/attributes in via `allowElement(&#39;object&#39;, [&#39;data&#39;])`, `allowElement(&#39;applet&#39;, [&#39;codebase&#39;])`, etc., or via `allowAttribute()`, no URL sanitization runs: `data=&#34;javascript:alert(1)&#34;` and similar payloads ship through unchanged into the output, enabling stored XSS.</p> <p>`&lt;meta http-equiv=&#34;refresh&#34; content=&#34;0; url=…&#34;&gt;` is the same class of bug routed differently: the URL is embedded inside a multi-field `content` attribute that the per-attribute sanitizer cannot detect from the attribute name alone. Integrators who enable `&lt;meta&gt;` with the `content` attribute (e.g. via `allowStaticElements()`) see `content=&#34;0; url=javascript:alert(1)&#34;` pass through, producing a refresh-driven navigation to a `javascript:` URL.</p> <p>Default configurations are not affected: `&lt;object&gt;`, `&lt;applet&gt;` and `&lt;iframe&gt;` are not in `W3CReference::BODY_ELEMENTS` and `&lt;meta&gt;` requires an explicit opt-in to `&lt;head&gt;`…</p> <p><strong>Affected:</strong> Packagist: symfony/html-sanitizer, Packagist: symfony/symfony</p> <p>### Description</p> <p>`Symfony\Component\HtmlSanitizer\Visitor\AttributeSanitizer\UrlAttributeSanitizer::getSupportedAttributes()` enumerates the attribute names whose values are scrubbed through `UrlSanitizer::sanitize()` (scheme and host allow-lists, `javascript:` rejection, BiDi check, etc.). The list is `[&#39;src&#39;, &#39;href&#39;, &#39;lowsrc&#39;, &#39;background&#39;, &#39;ping&#39;, &#39;action&#39;, &#39;formaction&#39;, &#39;poster&#39;, &#39;cite&#39;]`. Other URL-bearing attributes are absent: `&lt;object data=…&gt;`, `&lt;applet codebase=…&gt;`, `&lt;applet archive=…&gt;` and `&lt;object archive=…&gt;`, `&lt;iframe longdesc=…&gt;` and `&lt;img longdesc=…&gt;`. When an integrator opts these elements/attributes in via `allowElement(&#39;object&#39;, [&#39;data&#39;])`, `allowElement(&#39;applet&#39;, [&#39;codebase&#39;])`, etc., or via `allowAttribute()`, no URL sanitization runs: `data=&#34;javascript:alert(1)&#34;` and similar payloads ship through unchanged into the output, enabling stored XSS.</p> <p>`&lt;meta http-equiv=&#34;refresh&#34; content=&#34;0; url=…&#34;&gt;` is the same class of bug routed differently: the URL is embedded inside a multi-field `content` attribute that the per-attribute sanitizer cannot detect from the attribute name alone. Integrators who enable `&lt;meta&gt;` with the `content` attribute (e.g. via `allowStaticElements()`) see `content=&#34;0; url=javascript:alert(1)&#34;` pass through, producing a refresh-driven navigation to a `javascript:` URL.</p> <p>Default configurations are not affected: `&lt;object&gt;`, `&lt;applet&gt;` and `&lt;iframe&gt;` are not in `W3CReference::BODY_ELEMENTS` and `&lt;meta&gt;` requires an explicit opt-in to `&lt;head&gt;`…</p> https://cve.radiocsirt.org/vuln/ghsa-x5qj-865h-mgvm https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-48761 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: symfony, Ubuntu:Pro:18.04:LTS: symfony, Ubuntu:Pro:20.04:LTS: symfony, Ubuntu:Pro:22.04:LTS: symfony, Ubuntu:Pro:24.04:LTS: symfony, Ubuntu:25.10: symfony, Ubuntu:26.04:LTS: symfony</p> <p>Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlAttributeSanitizer::getSupportedAttributes() omitted URL-bearing attributes on &lt;object&gt;, &lt;applet&gt;, &lt;iframe&gt;, and &lt;img&gt;, and &lt;meta http-equiv=&#34;refresh&#34;&gt; URLs inside content bypassed URL sanitization, allowing explicitly enabled elements or attributes to pass javascript: and similar payloads into sanitized output. This issue is fixed in versions 6.4.41, 7.4.13, and 8.0.13.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: symfony, Ubuntu:Pro:18.04:LTS: symfony, Ubuntu:Pro:20.04:LTS: symfony, Ubuntu:Pro:22.04:LTS: symfony, Ubuntu:Pro:24.04:LTS: symfony, Ubuntu:25.10: symfony, Ubuntu:26.04:LTS: symfony</p> <p>Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlAttributeSanitizer::getSupportedAttributes() omitted URL-bearing attributes on &lt;object&gt;, &lt;applet&gt;, &lt;iframe&gt;, and &lt;img&gt;, and &lt;meta http-equiv=&#34;refresh&#34;&gt; URLs inside content bypassed URL sanitization, allowing explicitly enabled elements or attributes to pass javascript: and similar payloads into sanitized output. This issue is fixed in versions 6.4.41, 7.4.13, and 8.0.13.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-48761