Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

symfony — Vulnerabilities & Security Advisories 54

All 54 CVE vulnerabilities found in symfony, with AI-generated Chinese analysis, references, and POCs.

This page aggregates vulnerability data for the product Symfony. It collects security advisories and vulnerability reports related to Symfony, covering a broad historical range of disclosed issues. Readers can use this aggregation to track the vendor’s published security notices, analyze specific weakness classes associated with the framework, and review the product’s overall vulnerability history.

Vendor: symfony

CVE ID Title CVSS Severity Published
CVE-2026-50157 Auth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK CWE-598 6.5 Medium 2026-09-14
CVE-2026-48761 Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> content CWE-79 - - 2026-07-14
CVE-2026-48747 Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade CWE-347 - - 2026-07-14
CVE-2026-48489 Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes CWE-863 - - 2026-07-14
CVE-2026-48760 Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense CWE-451 - - 2026-07-14
CVE-2026-48736 Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient CWE-184 - - 2026-07-14
CVE-2026-48784 Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization CWE-172 - - 2026-07-14
CVE-2026-45068 Symfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address CWE-88 - - 2026-07-14
CVE-2026-47212 Symfony: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event Injection CWE-306 - - 2026-07-14
CVE-2026-45071 Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true CWE-611 - - 2026-07-14
CVE-2026-45755 Symfony: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection CWE-306 - - 2026-07-14
CVE-2026-45754 Symfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection CWE-287 - - 2026-07-14
CVE-2026-45305 Symfony: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex CWE-1333 - - 2026-07-14
CVE-2026-45304 Symfony: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs") CWE-776 - - 2026-07-14
CVE-2026-45069 Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims CWE-345 - - 2026-07-14
CVE-2026-45133 Symfony: [Yaml] Harden the parser when handling untrusted input CWE-674 - - 2026-07-14
CVE-2026-45075 Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid] CWE-863 - - 2026-07-14
CVE-2026-47767 Symfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch CWE-436 - - 2026-07-14
CVE-2026-45064 Symfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing CWE-451 - - 2026-07-14
CVE-2026-45063 Symfony: Identity Spoofing via Unanchored DN Regex in X509Authenticator CWE-290 - - 2026-07-14
CVE-2026-45070 Symfony: Email Header Injection via Non-Token Characters in Mime Parameter Names CWE-93 - - 2026-07-14
CVE-2026-45073 Symfony: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix CWE-89 - - 2026-07-14
CVE-2026-45753 Symfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS) CWE-79 - - 2026-07-14
CVE-2026-45072 Symfony: Stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering CWE-79 - - 2026-07-14
CVE-2026-45756 Symfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS CWE-400 - - 2026-07-14
CVE-2026-45066 Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification CWE-184 - - 2026-07-14
CVE-2026-45074 Symfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay CWE-290 - - 2026-07-14
CVE-2026-45077 Symfony: Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener CWE-502 - - 2026-07-14
CVE-2026-45065 Symfony: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection CWE-185 - - 2026-07-14
CVE-2026-45067 Symfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address CWE-93 - - 2026-07-14

All 54 known CVE vulnerabilities affecting symfony with full Chinese analysis, references, and POCs where available.