Flux
Toutes les sources

Symfony Blog

81 articles Flux RSS
Programmation Web
CVE-2026-45755: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC: Unauthenticated Webhook Event Injection

CVE-2026-45755: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC: Unauthenticated Webhook Event Injection

Affected versions Symfony versions >=7.2, =8.0, <8.0.12 of the Symfony Mailtrap Mailer component are affected by this security issue. The issue has been fixed in Symfony 7.4.12, 8.0.12. Description The Mailtrap mailer bridge ships…

Symfony Blog
CVE-2026-45756: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits: ReDoS

CVE-2026-45756: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits: ReDoS

Affected versions Symfony versions >=7.3, =8.0, <8.0.12 of the Symfony JSON Path component are affected by this security issue. The issue has been fixed in Symfony 7.4.12, 8.0.12. Description The JsonPath component's match() and search()…

Symfony Blog
CVE-2026-47212: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event Injection

CVE-2026-47212: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event Injection

Affected versions Symfony versions >=6.4, =7.0, =8.0, <8.0.12 of the Symfony Twilio Notifier component are affected by this security issue. The issue has been fixed in Symfony 6.4.40, 7.4.12, 8.0.12. Description The…

Symfony Blog
CVE-2026-45754: Mailjet and LOX24 Webhook Parsers Never Verify the Configured Secret: Unauthenticated Event Injection

CVE-2026-45754: Mailjet and LOX24 Webhook Parsers Never Verify the Configured Secret: Unauthenticated Event Injection

Affected versions Symfony versions >=6.4, =7.0, =8.0, <8.0.12 of the Symfony Lox24 Notifier and Symfony Mailjet Mailer components are affected by this security issue. The issue has been fixed in Symfony 6.4.40, 7.4.12,…

Symfony Blog