symfony vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-48489 Symfony is a PHP framework for web and console applications and a set of reusable PHP components.High 8.7 · Jul 14, 2026
• CVE-2026-45071 Symfony is a PHP framework for web and console applications and a set of reusable PHP components.High 8.7 · Jul 14, 2026
• CVE-2026-45068 Symfony is a PHP framework for web and console applications and a set of reusable PHP components.High 8.7 · Jul 14, 2026
• CVE-2026-47767 Symfony is a PHP framework for web and console applications and a set of reusable PHP components.High 8.3 · Jul 14, 2026
• CVE-2026-45305 Symfony is a PHP framework for web and console applications and a set of reusable PHP components.High 8.7 · Jul 14, 2026
• CVE-2026-45304 Symfony is a PHP framework for web and console applications and a set of reusable PHP components.High 8.7 · Jul 14, 2026
• CVE-2026-45133 Symfony is a PHP framework for web and console applications and a set of reusable PHP components.High 8.2 · Jul 14, 2026
• CVE-2026-45075 Symfony is a PHP framework for web and console applications and a set of reusable PHP components.High 8.3 · Jul 14, 2026
• CVE-2026-45069 Symfony is a PHP framework for web and console applications and a set of reusable PHP components.High 8.8 · Jul 14, 2026
• CVE-2026-45063 Symfony is a PHP framework for web and console applications and a set of reusable PHP components.Critical 9.1 · Jul 14, 2026
• CVE-2026-45756 Symfony is a PHP framework for web and console applications and a set of reusable PHP components.High 8.2 · Jul 14, 2026
• CVE-2026-45077 Symfony is a PHP framework for web and console applications and a set of reusable PHP components.High 8.3 · Jul 14, 2026
• CVE-2026-45074 Symfony is a PHP framework for web and console applications and a set of reusable PHP components.High 7.6 · Jul 14, 2026
• CVE-2026-55878 Symfony UX is a JavaScript ecosystem for Symfony.High 7.8 · Jul 8, 2026
• CVE-2025-64500 Symfony is a PHP framework for web and console applications and a set of reusable PHP components.High 7.3 · Nov 12, 2025
• CVE-2024-36611 In Symfony v7.07, a security vulnerability was identified in the FormLoginAuthenticator component, where it failed to adequately handle cases where the usernameHigh 7.5 · Nov 29, 2024
• CVE-2024-51996 Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes.High 7.5 · Nov 13, 2024
• CVE-2024-50340 symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state.High 7.3 · Nov 6, 2024
• CVE-2022-23601 Symfony is a PHP framework for web and console applications and a set of reusable PHP components.High 8.1 · Feb 1, 2022
• CVE-2020-15094 In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests.High 8 · Sep 2, 2020
• CVE-2020-5275 In symfony/security-http before versions 4.4.7 and 5.0.7, when a `Firewall` checks access control rule, it iterate overs each rule's attributes and stops as sooHigh 7.6 · Mar 30, 2020
• CVE-2018-13818 Twig before 2.4.4 allows Server-Side Template Injection (SSTI) via the search search_key parameter.Critical 9.8 · Jul 10, 2018
• CVE-2001-1537 The default "basic" security setting' in config.php for TWIG webmail 2.7.4 and earlier stores cleartext usernames and passwords in cookies, which could allow atHigh 7.5 · Dec 31, 2001