← All credits
Ilia Alshanetsky
8 vulnerability records and advisories credit this contributor.
CVE-2026-121949
Symfony: HtmlSanitizer Does Not URL-Sanitize srcset and imagesrcset: Media Scheme and Host Allow-List Bypass
CVE-2026-118517
Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority (Incomplete Fix for CVE-2026-45066)
CVE-2026-121373
Symfony: HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar (Incomplete Fix for CVE-2026-48761)
CVE-2026-91766
Cross-origin credential leak in HTTP stream wrapper redirects
CVE-2026-91768
IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)
CVE-2026-93682
Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header
CVE-2026-7262
NULL pointer dereference in SOAP apache:Map decoder with missing <value>
CVE-2026-7261
SoapServer session-persisted object use-after-free via SOAP header fault