Login Request a demo
SY
Product
symfony
by sensiolabs · last CVE Oct 15, 2026
92
CVEs
0
On KEV
9.8
Max CVSS
3
New 30D
Vulnerabilities92In the news0Timeline
Severity mix
Critical 11High 34Medium 36Low 0
Severity
All severities92Critical11High34Medium36Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add symfony to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-47767
9.8
1%
Jul 14
Symfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch
Affected: 5.4.46 before 5.4.52; 6.4.14 before 6.4.40; 7.1.7 before 7.4.12; 8.0.0 before 8.0.12
CVE-2024-51736
9.8
0%
Nov 6
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes
Affected: before 5.4.46; 6.0.0 before 6.4.14; 7.0.0 before 7.1.7
CVE-2019-18889
9.8
33%
Nov 21
An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7
Affected: 3.4.0 through 3.4.34; 4.2.0 through 4.2.11; 4.3.0 through 4.3.7
CVE-2019-11325
9.8
3%
Nov 21
An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8
Affected: 4.2.0 before 4.2.12; 4.3.0 before 4.3.8
CVE-2017-11365
9.8
2%
May 23
Certain Symfony products are affected by: Incorrect Access Control
Affected: 2.7.30; 2.8.23; 3.2.10; 3.3.3
CVE-2019-10913
9.8
2%
May 16
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be…
Affected: 2.7.0 before 2.7.51; 2.8.0 before 2.8.50; 3.4.0 before 3.4.26; 4.1.0 before 4.1.12; 4.2.0 before 4.2.7
CVE-2019-10910
9.8
6%
May 16
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection…
Affected: 2.7.0 before 2.7.51; 2.8.0 before 2.8.50; 3.4.0 before 3.4.26; 4.1.0 before 4.1.12; 4.2.0 before 4.2.7
CVE-2018-11407
9.8
2%
Jun 13
An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0.7
Affected: 2.8.0 before 2.8.37; 3.3.0 before 3.3.17; 3.4.0 before 3.4.7; 4.0.0 before 4.0.7
CVE-2016-2403
9.8
4%
Feb 7
Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an…
Affected: 2.8.0; 2.8.1; 2.8.2; 2.8.3; 2.8.4; 2.8.5; +6 more
CVE-2026-45069
9.1
0%
Jul 14
Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims
Affected: 6.3.0 before 6.4.40; 7.4.0 before 7.4.12; 8.0.0 before 8.0.12
CVE-2026-45063
9.1
0%
Jul 14
Symfony: Identity Spoofing via Unanchored DN Regex in X509Authenticator
Affected: before 5.4.52; 6.0.0 before 6.4.40; 7.0.0 before 7.4.12; 8.0.0 before 8.0.12
Showing 11