TI-2024-33775 CVE-2024-50340 · GHSA-x8vp-gf4q-mw5j
Ability to change environment from query in symfony/runtime
Priority HIGH 73
symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state.
symfony
Records95All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high36CVSS 7.0–8.9
Exploited now
symfony records in CISA KEVNo symfony vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
95 records
TI-2026-34283 CVE-2026-46628 · GHSA-4j38-f5cw-54h7
Twig: The `spaceless` filter implicitly marks its output as safe
Priority MEDIUM 56
Twig is a template language for PHP.
TI-2022-07667 CVE-2022-23614 · GHSA-5mv2-rx3q-4w2v
Code injection in Twig
Priority MEDIUM 54
Twig is an open source template language for PHP.
TI-2018-10028 CVE-2018-13818 · GHSA-rgff-87c8-rh44
Twig before 2.4.4 allows Server-Side Template Injection (SSTI) via the search search_key…
Priority MEDIUM 52
Twig before 2.4.4 allows Server-Side Template Injection (SSTI) via the search search_key parameter.
TI-2026-35851 CVE-2026-48489 · GHSA-6h46-9jf5-q59x
Incorrect authorization in symfony
Priority MEDIUM 45
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
TI-2026-35264 CVE-2026-47767 · GHSA-fqc7-9xjw-jrh3
Improper input validation in symfony
Priority MEDIUM 45
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
TI-2026-33105 CVE-2026-45305 · GHSA-9frc-8383-795m
Symfony: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex
Priority MEDIUM 45
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
TI-2026-33104 CVE-2026-45304 · GHSA-4qpc-3hr4-r2p4
Symfony: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")
Priority MEDIUM 45
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
TI-2022-18637 CVE-2022-39261 · GHSA-52m2-vc4m-jj33
Twig may load a template outside a configured directory when using the filesystem loader
Priority MEDIUM 45
Twig is a template language for PHP.
TI-2022-08704 CVE-2022-24894 · GHSA-h7vf-5wrv-9fhv
Symfony storing cookie headers in HttpCache
Priority MEDIUM 45
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
Priority MEDIUM 44
Twig is a template language for PHP.
TI-2026-32919 CVE-2026-45071 · GHSA-x6g4-fwcc-jj8w
Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true
Priority MEDIUM 44
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
TI-2026-32917 CVE-2026-45069 · GHSA-29fc-p6c4-24cg
Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims
Priority MEDIUM 44
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
TI-2026-32916 CVE-2026-45068 · GHSA-xx3c-qf5g-hc39
Symfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address
Priority MEDIUM 44
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
TI-2020-11869 CVE-2020-15094 · GHSA-754h-5r27-7x3r
RCE in Symfony
Priority MEDIUM 44
In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests.
TI-2026-33493 CVE-2026-45756 · GHSA-8v8v-g73j-492j
Symfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS
Priority MEDIUM 43
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
TI-2024-34642 CVE-2024-51736 · GHSA-qq5c-677p-737q
Command execution hijack on Windows with Process class in symfony/process
Priority MEDIUM 43
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes.
TI-2026-32923 CVE-2026-45075 · GHSA-6439-2f28-8p8q
Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
Priority MEDIUM 42
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
TI-2026-34292 CVE-2026-46640 · GHSA-45vw-wh46-2vx8
Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation
Priority MEDIUM 41
Twig is a template language for PHP.
TI-2026-34285 CVE-2026-46633 · GHSA-7p85-w9px-jpjp
Twig: PHP code injection via `{% use %}` template name
Priority MEDIUM 41
Twig is a template language for PHP.
TI-2026-32911 CVE-2026-45063 · GHSA-ph86-p8f6-f9r2
Symfony: Identity Spoofing via Unanchored DN Regex in X509Authenticator
Priority MEDIUM 41
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
TI-2026-19691 CVE-2026-24425 · GHSA-2q52-x2ff-qgfr
Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface
Priority MEDIUM 41
Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerability when using a SourcePolicyInterface that allows attackers with template rendering capabilities to pass arbitrary PHP callables to sort,…
TI-2024-30460 CVE-2024-45411 · GHSA-6j75-5wfj-gh66
Twig has a possible sandbox bypass
Priority MEDIUM 41
Twig is a template language for PHP.
TI-2022-07654 CVE-2022-23601 · GHSA-vvmr-8829-6whx
CSRF token missing in Symfony
Priority MEDIUM 41
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
TI-2021-18100 CVE-2021-41268 · GHSA-qw36-p97w-vcqr
Cookie persistence in Symfony
Priority MEDIUM 41
Symfony/SecurityBundle is the security system for Symfony, a PHP framework for web and console applications and a set of reusable PHP components.