Login Request a demo
SY
Vendor
symfony
25 products with CVEs on record
95
CVEs
0
On KEV
0
New 30D
Products
SY
symfony
symfony
9.8
30 CVEs0 on KEV0 new
TW
Twig
Symfony
9.9
25 CVEs0 on KEV0 new
UX
ux
symfony
7.8
9 CVEs0 on KEV0 new
HT
html-sanitizer
symfony
6.1
5 CVEs0 on KEV0 new
SE
security-http
symfony
9.1
4 CVEs0 on KEV0 new
TW
twig-bridge
symfony
6.1
2 CVEs0 on KEV0 new
YA
yaml
symfony
7.5
2 CVEs0 on KEV0 new
DO
dom-crawler
symfony
7.5
1 CVEs0 on KEV0 new
HT
http-client
symfony
8.6
1 CVEs0 on KEV0 new
HT
http-foundation
symfony
8.6
1 CVEs0 on KEV0 new
HT
http-kernel
symfony
8.2
1 CVEs0 on KEV0 new
JS
json-path
symfony
7.5
1 CVEs0 on KEV0 new
LO
lox24-notifier
symfony
5.3
1 CVEs0 on KEV0 new
MA
mailer
symfony
7.5
1 CVEs0 on KEV0 new
MA
mailjet-mailer
symfony
5.3
1 CVEs0 on KEV0 new
MA
mailomat-mailer
symfony
5.3
1 CVEs0 on KEV0 new
MI
mime
symfony
6.5
1 CVEs0 on KEV0 new
MO
monolog-bridge
symfony
8.6
1 CVEs0 on KEV0 new
PO
polyfill
symfony
6.9
1 CVEs0 on KEV0 new
PO
polyfill-intl-idn
symfony
6.9
1 CVEs0 on KEV0 new
RO
routing
symfony
6.1
1 CVEs0 on KEV0 new
RU
runtime
symfony
9.8
1 CVEs0 on KEV0 new
TW
twilio-notifier
symfony
5.3
1 CVEs0 on KEV0 new
UA
UX Autocomplete
Symfony
6.5
1 CVEs0 on KEV0 new
WE
web-profiler-bundle
symfony
5.4
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-49215
UX
ux
symfony
5.4
0%
Jul 17Symfony UX: CSRF Protection Bypass in symfony/ux-live-component — Accept Header is CORS-Safelisted
CVE-2026-49216
UX
ux
symfony
5.4
0%
Jul 17Symfony UX: XSS in symfony/ux-autocomplete via unescaped AJAX response data
CVE-2026-49211
UX
ux
symfony
7.5
1%
Jul 17Symfony UX: Information exposure via unescaped LIKE wildcards in EntitySearchUtil
CVE-2026-49208
UX
ux
symfony
5.3
0%
Jul 17Symfony UX: Format-less date LiveProps parsed with the permissive DateTime constructor
CVE-2026-49210
UX
ux
symfony
6.1
0%
Jul 17Symfony UX: XSS in symfony/ux-live-component via attacker-controlled child component tag
CVE-2026-49212
UX
ux
symfony
7.5
0%
Jul 17Symfony UX: LiveComponentHydrator HMAC checksum lacks component and slot binding
CVE-2026-49209
UX
ux
symfony
6.5
1%
Jul 17Symfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requests
CVE-2026-48807
TW
Twig
Symfony
9.1
0%
Jul 14Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters
CVE-2026-48806
TW
Twig
Symfony
9.1
0%
Jul 14Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys
CVE-2026-48808
TW
Twig
Symfony
7.5
0%
Jul 14Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`
CVE-2026-48805
TW
Twig
Symfony
9.1
0%
Jul 14Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`
CVE-2026-49981
TW
Twig
Symfony
8.2
0%
Jul 14Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`
CVE-2026-46637
TW
Twig
Symfony
5.4
0%
Jul 14Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`
CVE-2026-46638
TW
Twig
Symfony
8.1
0%
Jul 14Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)
CVE-2026-46640
TW
Twig
Symfony
8.8
1%
Jul 14Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation
CVE-2026-46629
TW
Twig
Symfony
6.5
1%
Jul 14Twig: Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments
CVE-2026-47730
TW
Twig
Symfony
5.4
0%
Jul 14Twig: XSS in profiler HtmlDumper via unescaped template and profile names
CVE-2026-46628
TW
Twig
Symfony
5.4
0%
Jul 14Twig: The `spaceless` filter implicitly marks its output as safe
CVE-2026-46634
TW
Twig
Symfony
9.8
1%
Jul 14Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name
CVE-2026-46627
TW
Twig
Symfony
6.5
1%
Jul 14Twig: Sandbox resource exhaustion via unbounded `for` / `range()`
CVE-2026-46633
TW
Twig
Symfony
9.8
1%
Jul 14Twig: PHP code injection via `{% use %}` template name
CVE-2026-46639
TW
Twig
Symfony
6.5
0%
Jul 14Twig: Sandbox property and method bypass via object-destructuring assignment
CVE-2026-46635
TW
Twig
Symfony
4.3
0%
Jul 14Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)
CVE-2026-47732
TW
Twig
Symfony
6.5
0%
Jul 14Twig Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points
CVE-2026-46644
PO
polyfill-intl-idn
symfony
6.9
1%
Jul 14symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence
CVE-2026-48761
HT
html-sanitizer
symfony
6.1
0%
Jul 14Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> content
CVE-2026-48747
MA
mailomat-mailer
symfony
5.3
0%
Jul 14Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade
CVE-2026-48489
SY
symfony
symfony
7.5
1%
Jul 14Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
CVE-2026-48760
SY
symfony
symfony
6.1
0%
Jul 14Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense
CVE-2026-48736
HT
http-client
symfony
8.6
1%
Jul 14Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient
CVE-2026-48784
RO
routing
symfony
6.1
0%
Jul 14Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization
CVE-2026-45068
MA
mailer
symfony
7.5
1%
Jul 14Symfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address
CVE-2026-47212
SY
symfony
symfony
5.3
2%
Jul 14Symfony: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event Injection
CVE-2026-45071
SY
symfony
symfony
7.5
1%
Jul 14Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true
CVE-2026-45755
SY
symfony
symfony
5.3
0%
Jul 14Symfony: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection
CVE-2026-45754
LO
lox24-notifier
symfony
5.3
0%
Jul 14Symfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection
CVE-2026-45305
SY
symfony
symfony
7.5
1%
Jul 14Symfony: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex
CVE-2026-45304
SY
symfony
symfony
7.5
1%
Jul 14Symfony: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")
CVE-2026-45069
SE
security-http
symfony
9.1
0%
Jul 14Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims
CVE-2026-45133
SY
symfony
symfony
7.5
1%
Jul 14Symfony: [Yaml] Harden the parser when handling untrusted input
CVE-2026-45075
SE
security-http
symfony
8.2
0%
Jul 14Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
CVE-2026-47767
RU
runtime
symfony
9.8
1%
Jul 14Symfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch
CVE-2026-45064
HT
html-sanitizer
symfony
6.1
0%
Jul 14Symfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing
CVE-2026-45063
SY
symfony
symfony
9.1
0%
Jul 14Symfony: Identity Spoofing via Unanchored DN Regex in X509Authenticator
CVE-2026-45070
SY
symfony
symfony
6.5
0%
Jul 14Symfony: Email Header Injection via Non-Token Characters in Mime Parameter Names
CVE-2026-45073
SY
symfony
symfony
7.3
0%
Jul 14Symfony: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix
CVE-2026-45753
HT
html-sanitizer
symfony
6.1
0%
Jul 14Symfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS)
CVE-2026-45072
TW
twig-bridge
symfony
5.4
0%
Jul 14Symfony: Stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering
CVE-2026-45756
JS
json-path
symfony
7.5
1%
Jul 14Symfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS
CVE-2026-45066
HT
html-sanitizer
symfony
6.1
0%
Jul 14Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification
CVE-2026-45074
SY
symfony
symfony
8.1
0%
Jul 14Symfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay
CVE-2026-45077
SY
symfony
symfony
8.6
1%
Jul 14Symfony: Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener
CVE-2026-45065
SY
symfony
symfony
6.1
0%
Jul 14Symfony: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection
CVE-2026-45067
SY
symfony
symfony
6.3
1%
Jul 14Symfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
CVE-2026-55877
UX
ux
symfony
6.1
0%
Jul 8Symfony UX: XSS in symfony/ux-icons via unsanitized SVG content in local files and Iconify on-demand responses
CVE-2026-55878
UX
ux
symfony
7.8
0%
Jul 8Symfony: Path Traversal in symfony/ux-toolkit Allows Arbitrary File Write and Read via Crafted Recipe Manifest
CVE-2026-24425
TW
Twig
Symfony
9.9
1%
May 20Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface
CVE-2026-24739
SY
symfony
symfony
6.3
0%
Jan 28Symfony has incorrect argument escaping under MSYS2/Git Bash on Windows that can lead to destructive file operations
CVE-2024-45411
TW
Twig
Symfony
8.6
1%
Sep 9Twig has a possible sandbox bypass
CVE-2023-46734
TW
Twig-bridge
Symfony
6.1
1%
Nov 10Symfony is a PHP framework for web and console applications and a set of reusable PHP components