[MEDIUM] symfony/ux-autocomplete Information exposure via unescaped LIKE wildcards in EntitySearchUtil

PKSA-msh7-gxqk-k56q CVE-2026-49211 GHSA-946h-jp5c-8fvh

Affected package: symfony/ux-autocomplete

Affected version: >=2.2.0,<2.36.0|>=3.0.0,<3.1.0

Reported by:
GitHub, FriendsOfPHP/security-advisories