symfony/http-kernel vulnerabilities (Packagist)

8 vulnerabilities.

• symfony/http-kernel Packagist Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid] CVE-2026-45075 Fix available 8.3 HighMay 27, 2026
• symfony/http-kernel Packagist Symfony allows direct access of ESI URLs behind a trusted proxy CVE-2014-5245 Fix available 7.5 HighMay 30, 2024
• symfony/http-kernel Packagist Symfony storing cookie headers in HttpCache CVE-2022-24894 Public exploitFix available 5.9 MediumFebruary 1, 2023
• symfony/http-kernel Packagist Webcache Poisoning in Symfony CVE-2021-41267 Fix available 6.5 MediumNovember 24, 2021
• symfony/http-kernel Packagist RCE in Symfony CVE-2020-15094 Fix available 8.0 HighSeptember 2, 2020
• symfony/http-kernel Packagist Symfony Http-Kernel has non-constant time comparison in UriSigner CVE-2019-18887 Fix available 8.1 HighNovember 18, 2019
• symfony/http-kernel Packagist Symfony Vulnerable to PHP Eval Injection CVE-2015-2308 Fix available 6.8 MediumJune 24, 2015
• symfony/http-kernel Packagist Symfony Incorrect Access Control CVE-2015-4050 Fix available 4.3 MediumMay 31, 2015