What’s Vulnerable › Products
symfony vulnerabilities
93 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 36 published in the last 12 months.
Check whether your symfony version is affected
Latest symfony vulnerabilities
- CVE-2026-48784 — Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization (CVSS 6.1)
- CVE-2026-48761 — Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> content (CVSS 6.1)
- CVE-2026-48760 — Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense (CVSS 6.1)
- CVE-2026-48747 — Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade (CVSS 5.3)
- CVE-2026-48736 — Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient (CVSS 8.6)
- CVE-2026-48489 — Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes (CVSS 7.5)
- CVE-2026-47212 — Symfony: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event Injection (CVSS 5.3)
- CVE-2026-45071 — Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true (CVSS 7.5)
- CVE-2026-45068 — Symfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address (CVSS 7.5)
- CVE-2026-47767 — Symfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch (CVSS 9.8)
- CVE-2026-45755 — Symfony: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection (CVSS 5.3)
- CVE-2026-45754 — Symfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection (CVSS 5.3)
- CVE-2026-45753 — Symfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS) (CVSS 6.1)
- CVE-2026-45305 — Symfony: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex (CVSS 7.5)
- CVE-2026-45304 — Symfony: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs") (CVSS 7.5)
- CVE-2026-45133 — Symfony: [Yaml] Harden the parser when handling untrusted input (CVSS 7.5)
- CVE-2026-45075 — Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid] (CVSS 8.2)
- CVE-2026-45073 — Symfony: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix (CVSS 7.3)
- CVE-2026-45072 — Symfony: Stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering (CVSS 5.4)
- CVE-2026-45070 — Symfony: Email Header Injection via Non-Token Characters in Mime Parameter Names (CVSS 6.5)
- CVE-2026-45069 — Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims (CVSS 9.1)
- CVE-2026-45064 — Symfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing (CVSS 6.1)
- CVE-2026-45063 — Symfony: Identity Spoofing via Unanchored DN Regex in X509Authenticator (CVSS 9.1)
- CVE-2026-45756 — Symfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS (CVSS 7.5)
- CVE-2026-45077 — Symfony: Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener (CVSS 8.6)