LOWPackagist
GHSA-34w5-c283-j9fg· CVE-2026-49212symfony/ux-live-component: LiveComponentHydrator HMAC checksum lacks component and slot binding
Modified: 9/10/2026
package
Packagist/symfony/ux-live-component
pkg:packagist/symfony/ux-live-component
MEDIUMPackagist
GHSA-38x5-rcv4-xf7x· CVE-2026-49210symfony/ux-live-component: XSS via attacker-controlled child component tag
Modified: 9/10/2026
LOWPackagist
GHSA-4m4j-hmqq-3gxm· CVE-2026-49215symfony/ux-live-component: CSRF Protection Bypass — Accept Header is CORS-Safelisted
Modified: 9/10/2026
MEDIUM6.1Packagist
GHSA-5j3w-5pcr-f8hg· CVE-2025-47946Symfony UX allows unsanitized HTML attribute injection via ComponentAttributes
Modified: 8/29/2025
MEDIUMPackagist
GHSA-89g7-22c8-3j23· CVE-2026-49208ux-live-component: Format-less date LiveProps parsed with the permissive DateTime constructor
Modified: 9/10/2026
LOWPackagist
GHSA-mm82-c99c-h2cf· CVE-2026-49209symfony/ux-live-component: Denial of service via unbounded batch action requests
Modified: 9/10/2026