TI-2026-36031 CVE-2026-48761 · GHSA-x5qj-865h-mgvm
Cross-site scripting in symfony
Priority LOW 24
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
Vulnerabilities
89 records
TI-2026-36018 CVE-2026-48747 · GHSA-rrj9-5q2j-4gvr
Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade
Priority LOW 28
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
TI-2026-35851 CVE-2026-48489 · GHSA-6h46-9jf5-q59x
Incorrect authorization in symfony
Priority MEDIUM 45
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
TI-2026-36030 CVE-2026-48760 · GHSA-v3wm-qf9p-c549
Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks…
Priority LOW 24
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
TI-2026-36012 CVE-2026-48736 · GHSA-38cx-cq6f-5755
Server-side request forgery in symfony
Priority LOW 31
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
TI-2026-36054 CVE-2026-48784 · GHSA-h5x3-xfc9-m39h
Open redirect in symfony
Priority LOW 29
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
TI-2026-32916 CVE-2026-45068 · GHSA-xx3c-qf5g-hc39
Symfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address
Priority MEDIUM 44
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
TI-2026-34800 CVE-2026-47212 · GHSA-55rj-x2vc-4whq
Missing authentication in symfony
Priority LOW 39
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
TI-2026-32919 CVE-2026-45071 · GHSA-x6g4-fwcc-jj8w
Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true
Priority MEDIUM 44
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
TI-2026-33492 CVE-2026-45755 · GHSA-59f3-vp2f-mp9w
Symfony: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection
Priority LOW 36
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
TI-2026-33491 CVE-2026-45754 · GHSA-64hg-93w9-fc35
Symfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection
Priority LOW 37
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
TI-2026-33105 CVE-2026-45305 · GHSA-9frc-8383-795m
Symfony: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex
Priority MEDIUM 45
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
TI-2026-33104 CVE-2026-45304 · GHSA-4qpc-3hr4-r2p4
Symfony: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")
Priority MEDIUM 45
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
TI-2026-32917 CVE-2026-45069 · GHSA-29fc-p6c4-24cg
Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims
Priority MEDIUM 44
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
TI-2026-32966 CVE-2026-45133 · GHSA-c2p3-7m5p-cv8x
Symfony: [Yaml] Harden the parser when handling untrusted input
Priority LOW 37
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
TI-2026-32923 CVE-2026-45075 · GHSA-6439-2f28-8p8q
Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
Priority MEDIUM 42
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
TI-2026-35264 CVE-2026-47767 · GHSA-fqc7-9xjw-jrh3
Improper input validation in symfony
Priority MEDIUM 45
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
TI-2026-32912 CVE-2026-45064 · GHSA-h5vq-qfcg-4m6p
Symfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing
Priority LOW 12
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
TI-2026-32911 CVE-2026-45063 · GHSA-ph86-p8f6-f9r2
Symfony: Identity Spoofing via Unanchored DN Regex in X509Authenticator
Priority MEDIUM 41
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
TI-2026-32918 CVE-2026-45070 · GHSA-vqc8-7275-q272
Symfony: Email Header Injection via Non-Token Characters in Mime Parameter Names
Priority LOW 34
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
TI-2026-32921 CVE-2026-45073 · GHSA-6qh9-h6wf-jgqc
Symfony: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix
Priority LOW 28
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
TI-2026-33490 CVE-2026-45753 · GHSA-hhg7-c65m-h7ff
Cross-site scripting in symfony
Priority LOW 11
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
TI-2026-32920 CVE-2026-45072 · GHSA-hmr5-2xcr-v8pp
Symfony: Stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering
Priority LOW 11
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
TI-2026-33493 CVE-2026-45756 · GHSA-8v8v-g73j-492j
Symfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS
Priority MEDIUM 43
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
TI-2026-32914 CVE-2026-45066 · GHSA-qc95-4862-92fh
Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser…
Priority LOW 12
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.