Login Request a demo
SE
Product
security-http
by symfony · last CVE Jul 14, 2026
4
CVEs
0
On KEV
9.1
Max CVSS
0
New 30D
Vulnerabilities4In the news0Timeline
Severity mix
Critical 1High 3Medium 0Low 0
Severity
All severities4Critical1High3Medium0Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add security-http to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-45075
8.2
0%
Jul 14
Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
Affected: >= 7.4.0-BETA1, < 7.4.12; >= 8.0.0-BETA1, < 8.0.12
CVE-2026-45074
8.1
0%
Jul 14
Symfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay
Affected: >= 7.1.0-BETA1, < 7.4.12; >= 8.0.0-BETA1, < 8.0.12
CVE-2026-48489
7.5
1%
Jul 14
Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
Affected: < 5.4.53; >= 6.0.0-BETA1, < 6.4.41; >= 7.0.0-BETA1, < 7.4.13; >= 8.0.0-BETA1, < 8.0.13
Showing 3