Product by Debian
Symfony
43 known vulnerabilities in Symfony (Debian), 0 of them actively exploited (CISA KEV).
Key figures
43
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-46626 | Debian Symfony: security vulnerability | — | |
| High | CVE-2024-50340 | Ability to change environment from query in symfony/runtime | 7.3 | |
| Medium | CVE-2018-14773 | SensioLabs Symfony: security vulnerability | 6.5 | |
| Medium | CVE-2026-47212 | Symfony: Missing Authentication for Critical Function | 5.3 | |
| High | CVE-2017-16654 | SensioLabs Symfony: Path Traversal | 7.5 | |
| High | CVE-2018-11385 | SensioLabs Symfony: Session Fixation | 8.1 | |
| Medium | CVE-2018-19789 | SensioLabs Symfony: File Inclusion | 5.3 | |
| High | CVE-2016-1902 | SensioLabs Symfony: security vulnerability | 7.5 | |
| High | CVE-2016-4423 | SensioLabs Symfony: Denial of Service | 7.5 | |
| High | CVE-2026-45304 | Symfony: XML Entity Expansion | 7.5 | |
| High | CVE-2026-45305 | Symfony: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex | 7.5 | |
| High | CVE-2026-45077 | Symfony: Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener | 8.6 | |
| High | CVE-2026-48489 | Symfony: Incorrect Authorization | 7.5 | |
| High | CVE-2026-45071 | Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true | 7.5 | |
| High | CVE-2026-45133 | Symfony: [Yaml] Harden the parser when handling untrusted input | 7.5 | |
| High | CVE-2026-48736 | Symfony: Incomplete List of Disallowed Inputs | 8.6 | |
| High | CVE-2026-45068 | Symfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address | 7.5 | |
| Medium | CVE-2017-16790 | SensioLabs Symfony: security vulnerability | 6.5 | |
| Medium | CVE-2018-11386 | SensioLabs Symfony: Denial of Service | 5.9 | |
| Medium | CVE-2018-19790 | SensioLabs Symfony: Open Redirect | 6.1 | |
| Critical | CVE-2026-45063 | Symfony: Identity Spoofing via Unanchored DN Regex in X509Authenticator | 9.1 | |
| Medium | CVE-2017-16653 | SensioLabs Symfony: Cross-Site Request Forgery (CSRF) | 5.9 | |
| Medium | CVE-2026-45067 | Symfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address | — | |
| High | CVE-2026-45073 | Symfony: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix | 7.3 | |
| Critical | CVE-2026-45069 | Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims | 9.1 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 28sans-atrisk-mail,