Your dependencies cross-checked against the OSV vulnerability database.
-
Serious GHSA-7p85-w9px-jpjp Twig: PHP code injection via `{% use %}` template name
/workdirs/scan-bc1d2060-dc29-4a47-8fd0-fbd8e0dc7354/composer.lock
A package you depend on has a known security hole (CVE-2026-46633). Fix: Update that package to its patched version.
-
Worth fixing GHSA-pw5c-xqf2-6xc2 Doctrine Security Misconfiguration Vulnerability
/workdirs/scan-bc1d2060-dc29-4a47-8fd0-fbd8e0dc7354/composer.lock
A package you depend on has a known security hole (CVE-2015-5723). Fix: Update that package to its patched version.
-
Worth fixing GHSA-pw5c-xqf2-6xc2 Doctrine Security Misconfiguration Vulnerability
/workdirs/scan-bc1d2060-dc29-4a47-8fd0-fbd8e0dc7354/composer.lock
A package you depend on has a known security hole (CVE-2015-5723). Fix: Update that package to its patched version.
-
Worth fixing GHSA-ph98-v78f-jqrm SQL injection in jackalope/jackalope-doctrine-dbal
/workdirs/scan-bc1d2060-dc29-4a47-8fd0-fbd8e0dc7354/composer.lock
A package you depend on has a known security hole (CVE-2021-43822). Fix: Update that package to its patched version.
-
Worth fixing GHSA-vvj3-c3rp-c85p PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling
/workdirs/scan-bc1d2060-dc29-4a47-8fd0-fbd8e0dc7354/composer.lock
A package you depend on has a known security hole (CVE-2026-24765). Fix: Update that package to its patched version.
-
Worth fixing GHSA-529h-vh3j-85hq Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`
/workdirs/scan-bc1d2060-dc29-4a47-8fd0-fbd8e0dc7354/composer.lock
A package you depend on has a known security hole (CVE-2026-49981). Fix: Update that package to its patched version.
-
Worth fixing GHSA-7fxw-r6jv-74c8 Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)
/workdirs/scan-bc1d2060-dc29-4a47-8fd0-fbd8e0dc7354/composer.lock
A package you depend on has a known security hole (CVE-2026-46638). Fix: Update that package to its patched version.
-
Worth fixing GHSA-pr2w-4gpj-cpq4 Twig: Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points
/workdirs/scan-bc1d2060-dc29-4a47-8fd0-fbd8e0dc7354/composer.lock
A package you depend on has a known security hole (CVE-2026-47732). Fix: Update that package to its patched version.
-
Worth fixing GHSA-xw83-pwrm-9j74 Twig remote code execution in templates
/workdirs/scan-bc1d2060-dc29-4a47-8fd0-fbd8e0dc7354/composer.lock
A package you depend on has a known security hole (CVE-2015-7809). Fix: Update that package to its patched version.
-
Minor GHSA-g3rh-rrhp-jhh9 Symfony has an incorrect response from Validator when input ends with `\n`
/workdirs/scan-bc1d2060-dc29-4a47-8fd0-fbd8e0dc7354/composer.lock
A package you depend on has a known security hole (CVE-2024-50343). Fix: Update that package to its patched version.
-
Minor GHSA-4qpc-3hr4-r2p4 Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")
/workdirs/scan-bc1d2060-dc29-4a47-8fd0-fbd8e0dc7354/composer.lock
A package you depend on has a known security hole (CVE-2026-45304). Fix: Update that package to its patched version.
-
Minor GHSA-9frc-8383-795m Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex
/workdirs/scan-bc1d2060-dc29-4a47-8fd0-fbd8e0dc7354/composer.lock
A package you depend on has a known security hole (CVE-2026-45305). Fix: Update that package to its patched version.
-
Minor GHSA-c2p3-7m5p-cv8x Symfony hardened the parser when handling untrusted input
/workdirs/scan-bc1d2060-dc29-4a47-8fd0-fbd8e0dc7354/composer.lock
A package you depend on has a known security hole (CVE-2026-45133). Fix: Update that package to its patched version.
-
Minor GHSA-4j38-f5cw-54h7 Twig: The `spaceless` filter implicitly marks its output as safe
/workdirs/scan-bc1d2060-dc29-4a47-8fd0-fbd8e0dc7354/composer.lock
A package you depend on has a known security hole (CVE-2026-46628). Fix: Update that package to its patched version.
-
Minor GHSA-6377-hfv9-hqf6 Twig has unguarded calls to `__toString()` when nesting an object into an array
/workdirs/scan-bc1d2060-dc29-4a47-8fd0-fbd8e0dc7354/composer.lock
A package you depend on has a known security hole (CVE-2024-51754). Fix: Update that package to its patched version.
-
Minor GHSA-jjxq-ff2g-95vh Twig has unguarded calls to `__isset()` and to array-accesses when the sandbox is enabled
/workdirs/scan-bc1d2060-dc29-4a47-8fd0-fbd8e0dc7354/composer.lock
A package you depend on has a known security hole (CVE-2024-51755). Fix: Update that package to its patched version.
-
Minor GHSA-p42q-9prx-q5wq Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`
/workdirs/scan-bc1d2060-dc29-4a47-8fd0-fbd8e0dc7354/composer.lock
A package you depend on has a known security hole (CVE-2026-48805). Fix: Update that package to its patched version.
-
Minor GHSA-vcc8-phrv-43wj Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)
/workdirs/scan-bc1d2060-dc29-4a47-8fd0-fbd8e0dc7354/composer.lock
A package you depend on has a known security hole (CVE-2026-46635). Fix: Update that package to its patched version.
-
Minor GHSA-vxrc-68xx-x48g Twig Sandbox Information Disclosure
/workdirs/scan-bc1d2060-dc29-4a47-8fd0-fbd8e0dc7354/composer.lock
A package you depend on has a known security hole (CVE-2019-9942). Fix: Update that package to its patched version.
-
FYI GHSA-5v5v-ww74-355v Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys
/workdirs/scan-bc1d2060-dc29-4a47-8fd0-fbd8e0dc7354/composer.lock
A package you depend on has a known security hole (CVE-2026-48806). Fix: Update that package to its patched version.
-
FYI GHSA-8x9c-rmqh-456c Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters
/workdirs/scan-bc1d2060-dc29-4a47-8fd0-fbd8e0dc7354/composer.lock
A package you depend on has a known security hole (CVE-2026-48807). Fix: Update that package to its patched version.
-
FYI GHSA-h8vq-8gpg-mhcg Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`
/workdirs/scan-bc1d2060-dc29-4a47-8fd0-fbd8e0dc7354/composer.lock
A package you depend on has a known security hole (CVE-2026-48808). Fix: Update that package to its patched version.