SE
Vendor
sensiolabs
95
CVEs
0
On KEV
3
New 30D
Products
SY9.8
symfony
sensiolabs
92 CVEs0 on KEV3 new
HT8.8
Httpclient
Sensiolabs
2 CVEs0 on KEV0 new
HT7.3
Httpfoundation
Sensiolabs
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-109449 | SY symfony sensiolabs | 8.7 | Oct 15 | Symfony: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process |
| CVE-2026-109413 | SY symfony sensiolabs | 8.7 | Oct 15 | Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process |
| CVE-2026-108082 | SY symfony sensiolabs | 8.7 | Oct 15 | Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header |
| CVE-2026-48761 | SY Symfony Sensiolabs | 6.1 | Jul 14 | Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> content |
| CVE-2026-48747 | SY Symfony Sensiolabs | 5.3 | Jul 14 | Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade |
| CVE-2026-48489 | SY Symfony Sensiolabs | 7.5 | Jul 14 | Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes |
| CVE-2026-48760 | SY Symfony Sensiolabs | 6.1 | Jul 14 | Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense |
| CVE-2026-48736 | SY Symfony Sensiolabs | 8.6 | Jul 14 | Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient |
| CVE-2026-48784 | SY Symfony Sensiolabs | 6.1 | Jul 14 | Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization |
| CVE-2026-45068 | SY Symfony Sensiolabs | 7.5 | Jul 14 | Symfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address |
| CVE-2026-47212 | SY Symfony Sensiolabs | 5.3 | Jul 14 | Symfony: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event Injection |
| CVE-2026-45071 | SY Symfony Sensiolabs | 7.5 | Jul 14 | Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true |
| CVE-2026-45755 | SY Symfony Sensiolabs | 5.3 | Jul 14 | Symfony: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection |
| CVE-2026-45754 | SY Symfony Sensiolabs | 5.3 | Jul 14 | Symfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection |
| CVE-2026-45305 | SY Symfony Sensiolabs | 7.5 | Jul 14 | Symfony: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex |
| CVE-2026-45304 | SY Symfony Sensiolabs | 7.5 | Jul 14 | Symfony: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs") |
| CVE-2026-45069 | SY Symfony Sensiolabs | 9.1 | Jul 14 | Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims |
| CVE-2026-45133 | SY Symfony Sensiolabs | 7.5 | Jul 14 | Symfony: [Yaml] Harden the parser when handling untrusted input |
| CVE-2026-45075 | SY Symfony Sensiolabs | 8.2 | Jul 14 | Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid] |
| CVE-2026-47767 | SY Symfony Sensiolabs | 9.8 | Jul 14 | Symfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch |
| CVE-2026-45064 | SY Symfony Sensiolabs | 6.1 | Jul 14 | Symfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing |
| CVE-2026-45063 | SY Symfony Sensiolabs | 9.1 | Jul 14 | Symfony: Identity Spoofing via Unanchored DN Regex in X509Authenticator |
| CVE-2026-45070 | SY Symfony Sensiolabs | 6.5 | Jul 14 | Symfony: Email Header Injection via Non-Token Characters in Mime Parameter Names |
| CVE-2026-45073 | SY Symfony Sensiolabs | 7.3 | Jul 14 | Symfony: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix |
| CVE-2026-45753 | SY Symfony Sensiolabs | 6.1 | Jul 14 | Symfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS) |
| CVE-2026-45072 | SY Symfony Sensiolabs | 5.4 | Jul 14 | Symfony: Stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering |
| CVE-2026-45756 | SY Symfony Sensiolabs | 7.5 | Jul 14 | Symfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS |
| CVE-2026-45066 | SY Symfony Sensiolabs | 6.1 | Jul 14 | Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification |
| CVE-2026-45074 | SY Symfony Sensiolabs | 8.1 | Jul 14 | Symfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay |
| CVE-2026-45077 | SY Symfony Sensiolabs | 8.6 | Jul 14 | Symfony: Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener |
| CVE-2026-45065 | SY Symfony Sensiolabs | 6.1 | Jul 14 | Symfony: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection |
| CVE-2026-24739 | SY Symfony Sensiolabs | 6.3 | Jan 28 | Symfony has incorrect argument escaping under MSYS2/Git Bash on Windows that can lead to destructive file operations |
| CVE-2025-64500 | SY Symfony Sensiolabs | 7.3 | Nov 12 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components |
| CVE-2024-51736 | SY Symfony Sensiolabs | 9.8 | Nov 6 | Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes |
| CVE-2024-50345 | SY Symfony Sensiolabs | 6.1 | Nov 6 | symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification |
| CVE-2024-50342 | HT Httpclient Sensiolabs | 4.3 | Nov 6 | symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously |
| CVE-2023-46735 | SY Symfony Sensiolabs | 6.1 | Nov 10 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components |
| CVE-2023-46734 | SY Symfony Sensiolabs | 6.1 | Nov 10 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components |
| CVE-2023-46733 | SY Symfony Sensiolabs | 6.5 | Nov 10 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components |
| CVE-2022-24895 | SY Symfony Sensiolabs | 8.8 | Feb 3 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components |
| CVE-2022-24894 | SY Symfony Sensiolabs | 8.8 | Feb 3 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components |
| CVE-2022-23601 | SY Symfony Sensiolabs | 8.8 | Feb 1 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components |
| CVE-2021-41270 | SY Symfony Sensiolabs | 6.5 | Nov 24 | Symfony/Serializer handles serializing and deserializing data structures for Symfony, a PHP framework for web and console applications and a set of reusable PHP components |
| CVE-2021-41268 | SY Symfony Sensiolabs | 8.8 | Nov 24 | Symfony/SecurityBundle is the security system for Symfony, a PHP framework for web and console applications and a set of reusable PHP components |
| CVE-2021-41267 | SY Symfony Sensiolabs | 6.5 | Nov 24 | Symfony/Http-Kernel is the HTTP kernel component for Symfony, a PHP framework for web and console applications and a set of reusable PHP components |
| CVE-2021-32693 | SY Symfony Sensiolabs | 8.8 | Jun 17 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components |
| CVE-2021-21424 | SY Symfony Sensiolabs | 5.3 | May 13 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components |
| CVE-2020-15094 | HT Httpclient Sensiolabs | 8.8 | Sep 2 | In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests |
| CVE-2020-5275 | SY Symfony Sensiolabs | 8.1 | Mar 30 | In symfony/security-http before versions 4.4.7 and 5.0.7, when a `Firewall` checks access control rule, it iterate overs each rule's attributes and stops as soon as the… |
| CVE-2020-5274 | SY Symfony Sensiolabs | 5.4 | Mar 30 | In Symfony before versions 5.0.5 and 4.4.5, some properties of the Exception were not properly escaped when the `ErrorHandler` rendered it stacktrace |
| CVE-2020-5255 | SY Symfony Sensiolabs | 4.3 | Mar 30 | In Symfony before versions 4.4.7 and 5.0.7, when a `Response` does not contain a `Content-Type` header, affected versions of Symfony can fallback to the format defined in the… |
| CVE-2013-4752 | SY Symfony Sensiolabs | 6.1 | Jan 2 | Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and 2.3.X before 2.3.3 have an issue in the HttpFoundation component |
| CVE-2019-18889 | SY Symfony Sensiolabs | 9.8 | Nov 21 | An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7 |
| CVE-2019-18888 | SY Symfony Sensiolabs | 7.5 | Nov 21 | An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7 |
| CVE-2019-18887 | SY Symfony Sensiolabs | 8.1 | Nov 21 | An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7 |
| CVE-2019-11325 | SY Symfony Sensiolabs | 9.8 | Nov 21 | An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8 |
| CVE-2019-18886 | SY Symfony Sensiolabs | 5.3 | Nov 21 | An issue was discovered in Symfony 4.2.0 to 4.2.11 and 4.3.0 to 4.3.7 |
| CVE-2013-4751 | SY Symfony Sensiolabs | 8.1 | Nov 1 | php-symfony2-Validator has loss of information during serialization |
| CVE-2017-11365 | SY Symfony Sensiolabs | 9.8 | May 23 | Certain Symfony products are affected by: Incorrect Access Control |
| CVE-2019-10913 | SY Symfony Sensiolabs | 9.8 | May 16 | In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be… |