Security advisories

medium2026-06-19

CVE-2026-49216-symfony/ux-autocomplete: XSS via unescaped AJAX response data

symfony/ux · GHSA-mwqm-4fw3-cjvr

low2026-06-19

CVE-2026-49215-symfony/ux-live-component: CSRF Protection Bypass — Accept Header is CORS-Safelisted

symfony/ux · GHSA-4m4j-hmqq-3gxm

low2026-06-19

CVE-2026-49212-symfony/ux-live-component: LiveComponentHydrator HMAC checksum lacks component and slot binding

symfony/ux · GHSA-34w5-c283-j9fg

medium2026-06-19

CVE-2026-49211-symfony/ux-autocomplete: Information exposure via unescaped LIKE wildcards in EntitySearchUtil

symfony/ux · GHSA-946h-jp5c-8fvh

medium2026-06-19

CVE-2026-49210-symfony/ux-live-component: XSS via attacker-controlled child component tag

symfony/ux · GHSA-38x5-rcv4-xf7x

low2026-06-19

CVE-2026-49209-symfony/ux-live-component: Denial of service via unbounded batch action requests

symfony/ux · GHSA-mm82-c99c-h2cf

medium2026-06-19

CVE-2026-50008-parse-server: Server option routeAllowList is bypassable through batch sub-requests

parse-community/parse-server · GHSA-p84r-h6rx-f2xr

medium2026-06-19

CVE-2026-47262-containerd image-triggered runtime DoS via unbounded group parsing

containerd/containerd · GHSA-jpcc-p29g-p8mq

high2026-06-19

CVE-2026-54899-Oj: Use-After-Free in Oj::Parser Symbol Key Cache Toggle

ohler55/oj · GHSA-2cw7-v8ff-p88r

medium2026-06-19

CVE-2026-49208-ux-live-component: Format-less date LiveProps parsed with the permissive DateTime constructor

symfony/ux · GHSA-89g7-22c8-3j23

high2026-06-19

CVE-2026-23879-py7zr: Arbitrary File Write Vulnerability

miurahr/py7zr · GHSA-q6rc-2cgv-63h7

medium2026-06-19

TypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy (MySQL/MariaDB)

typeorm/typeorm · GHSA-9ggv-8w38-r7pm

high2026-06-19

Hugo: security.http.urls deny rules bypassed by alternate IPv4 encodings (SSRF)

gohugoio/hugo · GHSA-r46f-3rpw-hxrv

high2026-06-19

AlchemyCMS: Unauthenticated nested page API leaks restricted & unpublished content

alchemycms/alchemy_cms · GHSA-mqq5-j7w8-2hgh

medium2026-06-19

Hugo: Symlink confinement bypass in os.ReadFile

gohugoio/hugo · GHSA-c3wq-j5vh-68rc

medium2026-06-19

Hugo: XSS via unescaped code-fence language in default code block renderer

gohugoio/hugo · GHSA-q76j-gcg9-vxc6

low2026-06-19

OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source

openzeppelin/contracts-wizard · GHSA-9wxg-vf3r-56hc

low2026-06-19

Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`

sparklemotion/nokogiri · GHSA-phwj-rprq-35pp

low2026-06-19

Nokogiri: Possible Use-After-Free in XInclude Processing

sparklemotion/nokogiri · GHSA-wfpw-mmfh-qq69

low2026-06-19

Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime

sparklemotion/nokogiri · GHSA-p67v-3w7g-wjg7