SE
Product
security-http
4
CVEs
0
On KEV
9.1
Max CVSS
0
New 30D
Severity mix
Critical 1High 3Medium 0Low 0
Watch
Add security-http to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-45069 | 9.1 | Jul 14 | Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims Affected: >= 6.3.0, < 6.4.40; >= 7.4.0, < 7.4.12; >= 8.0.0-BETA1, < 8.0.12 |
| CVE-2026-45075 | 8.2 | Jul 14 | Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid] Affected: >= 7.4.0-BETA1, < 7.4.12; >= 8.0.0-BETA1, < 8.0.12 |
| CVE-2026-45074 | 8.1 | Jul 14 | Symfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay Affected: >= 7.1.0-BETA1, < 7.4.12; >= 8.0.0-BETA1, < 8.0.12 |
| CVE-2026-48489 | 7.5 | Jul 14 | Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes Affected: < 5.4.53; >= 6.0.0-BETA1, < 6.4.41; >= 7.0.0-BETA1, < 7.4.13; >= 8.0.0-BETA1, < 8.0.13 |
Showing 4