Skip to contentSymfony vulnerabilities
Newest
- eemeli yaml, sensiolabs symfony +1 moreSymfony: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() RegexCVE-2026-45305Fix available8.7 High
- eemeli yaml, sensiolabs symfony +1 moreSymfony: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")CVE-2026-45304Fix available8.7 High
- sensiolabs symfonySymfony: [Yaml] Harden the parser when handling untrusted inputCVE-2026-45133Fix available8.2 High
- sensiolabs symfony, symfony monolog-bridge +1 moreSymfony: Unauthenticated PHP Object Deserialization in MonologBridge server:log ListenerCVE-2026-45077Fix available8.3 High
- sensiolabs symfony, symfony http-kernel, security-http +2 moreSymfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]CVE-2026-45075Fix available8.3 High
- sensiolabs symfony, symfony security-http +1 moreSymfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket ReplayCVE-2026-45074Fix available7.6 High
- cache symfonySymfony: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefixCVE-2026-45073Fix available6.3 Medium
- sensiolabs symfony, symfony twig-bridge, web-profiler-bundle +2 moreSymfony: Stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File RenderingCVE-2026-45072Fix available2.0 Low
- sensiolabs symfony, symfony dom-crawler +1 moreSymfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = trueCVE-2026-45071Public exploitFix available8.7 High
- go standard library mime, sensiolabs symfony +1 moreSymfony: Email Header Injection via Non-Token Characters in Mime Parameter NamesCVE-2026-45070Fix available6.3 Medium
- sensiolabs symfony, symfony security-http +1 moreSymfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp ClaimsCVE-2026-45069Fix available8.8 High
- sensiolabs symfony, symfony mailer +1 moreSymfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient AddressCVE-2026-45068Fix available8.7 High
- symfonySymfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\AddressCVE-2026-45067Public exploitFix available6.3 Medium
- sensiolabs symfony, symfony html-sanitizer +1 moreSymfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> MisclassificationCVE-2026-45066Fix available2.3 Low
- sensiolabs symfony, symfony html-sanitizer +1 moreSymfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href SpoofingCVE-2026-45064Fix available2.3 Low
- sensiolabs symfonySymfony: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL InjectionCVE-2026-45065Fix available2.3 Low
- sensiolabs symfonySymfony: Identity Spoofing via Unanchored DN Regex in X509AuthenticatorCVE-2026-45063Fix available9.1 Critical
- symfony twigTwig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilationCVE-2026-46640Fix available8.7 High
- symfony twigTwig: Sandbox property and method bypass via object-destructuring assignmentCVE-2026-46639Fix available7.1 High
- symfony twigTwig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)CVE-2026-46638Fix available6.0 Medium
- symfony twig, twig cssinliner-extra, markdown-extra +2 moreTwig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`CVE-2026-46637Fix available5.1 Medium
- symfony twigTwig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)CVE-2026-46635Fix available5.3 Medium
- symfony twigTwig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template nameCVE-2026-46634Fix available7.7 High
- symfony twigTwig: PHP code injection via `{% use %}` template nameCVE-2026-46633Fix available8.7 High
- symfony twigTwig: Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled argumentsCVE-2026-46629Fix available5.3 Medium
- symfony twigTwig: The `spaceless` filter implicitly marks its output as safeCVE-2026-46628Fix available5.1 Medium
- symfony twigTwig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterfaceCVE-2026-24425Fix available8.7 High
- sensiolabs symfonySymfony has incorrect argument escaping under MSYS2/Git Bash on Windows that can lead to destructive file operationsCVE-2026-24739Fix available6.3 Medium
- sensiolabs httpfoundation, symfony +1 moreSymfony's incorrect parsing of PATH_INFO can lead to limited authorization bypassCVE-2025-64500Fix available7.3 High
- symfony uxsymfony/ux-live-component and symfony/ux-twig-component vulnerable to unsanitized HTML attribute injection via ComponentAttributesCVE-2025-47946Fix available6.1 Medium
- symfonyWithdrawn Advisory: Symfony http-security has authentication bypassCVE-2024-36611Fix availableDisputed7.5 High
- symfony, symphony php framework process +1 moreSymphony has an Authentication Bypass via RememberMeCVE-2024-51996Public exploitFix available7.5 High
- sensiolabs symfonyCommand execution hijack on Windows with Process class in symfony/processCVE-2024-51736Fix available0.0 None
- sensiolabs symfonyOpen redirect via browser-sanitized URLs in symfony/http-foundationCVE-2024-50345Fix available3.1 Low
- symfonyIncorrect response from Validator when input ends with `\n` in symfony/validatorCVE-2024-50343Fix available3.1 Low
- sensiolabs httpclient, symfony +1 moreInternal address and port enumeration allowed by NoPrivateNetworkHttpClient in symfony/http-clientCVE-2024-50342Fix available3.1 Low
- symfonySecurity::login does not take into account custom user_checker in symfony/security-bundleCVE-2024-50341Fix available3.1 Low
- sensiolabs symfonyAbility to change environment from query in symfony/runtimeCVE-2024-50340Public exploitFix availableEPSS 61.8%7.3 High
- symfony twigTwig has a possible sandbox bypassCVE-2024-45411Fix available8.6 High
- sensiolabs symfonySymfony potential Cross-site Scripting in WebhookControllerCVE-2023-46735Fix available6.1 Medium
- sensiolabs symfony, debian linux, symfony twig-bridge +2 moreSymfony potential Cross-site Scripting vulnerabilities in CodeExtension filtersCVE-2023-46734Fix available6.1 Medium
- sensiolabs symfonySymfony possible session fixation vulnerabilityCVE-2023-46733Fix available6.5 Medium
- symfony ux-autocomplete, ux autocomplete +1 morePrevent injection of invalid entity ids for "autocomplete" fields in symfony ux-autocompleteCVE-2023-41336Fix available6.5 Medium
- sensiolabs symfonySymfony storing cookie headers in HttpCacheCVE-2022-24894Public exploitFix available5.9 Medium
- sensiolabs symfonySymfony vulnerable to Session Fixation of CSRF tokensCVE-2022-24895Fix available6.3 Medium
- symfony twig, debian linux, drupal +1 more +3 moreTwig may load a template outside a configured directory when using the filesystem loaderCVE-2022-39261Fix available7.5 High
- symfony twig, debian linux, fedoraproject fedora +2 moreCode injection in TwigCVE-2022-23614Public exploitFix available8.8 High
- sensiolabs symfonyCSRF token missing in SymfonyCVE-2022-23601Fix available8.1 High
- sensiolabs symfony, fedoraproject fedora +1 moreCSV Injection in SymfonyCVE-2021-41270Fix available6.5 Medium
- sensiolabs symfonyWebcache Poisoning in SymfonyCVE-2021-41267Fix available6.5 Medium
- Show moreLoading…