Feed live

symfony CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,227

All time

Critical · Active

11,982

CVSS ≥ 9.0

New · 14 days

2,687

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 1–30 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-49209	medium	5.3/10	Symfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requests	Jul 17, 2026 1mo ago
CVE-2026-46644	medium	6.9/10	symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence	Jul 14, 2026 1mo ago
CVE-2026-48736	medium	6.9/10	Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient	Jul 14, 2026 1mo ago
CVE-2026-45068	high	8.7/10	Symfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address	Jul 14, 2026 1mo ago
CVE-2026-45755	medium	6.9/10	Symfony: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection	Jul 14, 2026 1mo ago
CVE-2026-45069	high	8.8/10	Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims	Jul 14, 2026 1mo ago
CVE-2026-45064	low	2.3/10	Symfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing	Jul 14, 2026 1mo ago
CVE-2026-45063	critical	9.1/10	Symfony: Identity Spoofing via Unanchored DN Regex in X509Authenticator	Jul 14, 2026 1mo ago
CVE-2026-45065	low	2.3/10	Symfony: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection	Jul 14, 2026 1mo ago
CVE-2026-55877	medium	6.1/10	Symfony UX: XSS in symfony/ux-icons via unsanitized SVG content in local files and Iconify on-demand responses	Jul 8, 2026 1mo ago
CVE-2026-55878	high	7.8/10	Symfony: Path Traversal in symfony/ux-toolkit Allows Arbitrary File Write and Read via Crafted Recipe Manifest	Jul 8, 2026 1mo ago
CVE-2026-28695	high	7.5/10	Craft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadget	Mar 4, 2026 5mo ago
CVE-2026-24739	medium	6.3/10	Symfony has incorrect argument escaping under MSYS2/Git Bash on Windows that can lead to destructive file operations	Jan 28, 2026 6mo ago
CVE-2025-64500	high	7.3/10	Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass	Nov 12, 2025 9mo ago
CVE-2025-47946	medium	6.1/10	symfony/ux-live-component and symfony/ux-twig-component vulnerable to unsanitized HTML attribute injection via ComponentAttributes	May 19, 2025 1y ago
CVE-2024-13250	—	—	Drupal Symfony Mailer Lite - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-014	Jan 9, 2025 1y ago
CVE-2024-50340	high	7.3/10	Ability to change environment from query in symfony/runtime	Nov 6, 2024 1y ago
CVE-2024-50341	low	3.1/10	Security::login does not take into account custom user_checker in symfony/security-bundle	Nov 6, 2024 1y ago
CVE-2024-50342	low	3.1/10	Internal address and port enumeration allowed by NoPrivateNetworkHttpClient in symfony/http-client	Nov 6, 2024 1y ago
CVE-2024-50343	low	3.1/10	Incorrect response from Validator when input ends with `\n` in symfony/validator	Nov 6, 2024 1y ago
CVE-2024-50345	low	3.1/10	Open redirect via browser-sanitized URLs in symfony/http-foundation	Nov 6, 2024 1y ago
CVE-2024-51736	—	0.0/10	Command execution hijack on Windows with Process class in symfony/process	Nov 6, 2024 1y ago
CVE-2024-28861	critical	9.8/10	Gadget chain in Symfony 1 due to uncontrolled unserialized input in sfNamespacedParameterHolder	Mar 22, 2024 2y ago
CVE-2024-28859	medium	5.0/10	Gadget chain in Symfony 1 due to vulnerable Swift Mailer dependency	Mar 15, 2024 2y ago
CVE-2023-46735	medium	6.1/10	Symfony potential Cross-site Scripting in WebhookController	Nov 10, 2023 2y ago
CVE-2023-46734	medium	6.1/10	Symfony potential Cross-site Scripting vulnerabilities in CodeExtension filters	Nov 10, 2023 2y ago
CVE-2023-46733	medium	6.5/10	Symfony possible session fixation vulnerability	Nov 10, 2023 2y ago
CVE-2023-41336	medium	6.5/10	Prevent injection of invalid entity ids for "autocomplete" fields in symfony ux-autocomplete	Sep 11, 2023 2y ago
CVE-2022-23601	high	8.1/10	CSRF token missing in Symfony	Feb 1, 2022 4y ago
CVE-2021-41270	medium	6.5/10	CSV Injection in Symfony	Nov 24, 2021 4y ago