Vendor
Symfony
90 known vulnerabilities in products by Symfony, 0 of them actively exploited (CISA KEV).
Key figures
90
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
12
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2024-50340 | Ability to change environment from query in symfony/runtime | 7.3 | |
| Critical | CVE-2018-13818 | Twig: Template Injection | 9.8 | |
| Critical | CVE-2022-23614 | Code injection in Twig | 8.8 | |
| High | CVE-2020-15094 | RCE in Symfony | 8.0 | |
| High | CVE-2022-39261 | Twig may load a template outside a configured directory when using the filesystem loader | 7.5 | |
| Medium | CVE-2026-47212 | Symfony: Missing Authentication for Critical Function | 5.3 | |
| High | CVE-2022-24894 | Symfony storing cookie headers in HttpCache | 5.9 | |
| Critical | CVE-2026-47767 | Symfony: Interpretation Conflict | 9.8 | |
| Critical | CVE-2026-46633 | Twig: PHP code injection via `{% use %}` template name | 9.8 | |
| High | CVE-2025-64500 | Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass | 7.3 | |
| Critical | CVE-2026-46634 | Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name | 9.8 | |
| High | CVE-2026-45305 | Symfony: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex | 7.5 | |
| High | CVE-2026-45304 | Symfony: XML Entity Expansion | 7.5 | |
| Critical | CVE-2026-24425 | Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface | 8.8 | |
| High | CVE-2026-46640 | Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation | 8.8 | |
| High | CVE-2026-45077 | Symfony: Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener | 8.6 | |
| High | CVE-2026-48489 | Symfony: Incorrect Authorization | 7.5 | |
| High | CVE-2026-45071 | Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true | 7.5 | |
| High | CVE-2026-45133 | Symfony: [Yaml] Harden the parser when handling untrusted input | 7.5 | |
| High | CVE-2026-45756 | Symfony: Inefficient Regular Expression Complexity | 7.5 | |
| High | CVE-2026-48736 | Symfony: Incomplete List of Disallowed Inputs | 8.6 | |
| Critical | CVE-2026-48805 | Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php` | 9.1 | |
| High | CVE-2026-45068 | Symfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address | 7.5 | |
| Critical | CVE-2026-48806 | Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys | 9.1 | |
| High | CVE-2024-45411 | Twig has a possible sandbox bypass | 8.6 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 28sans-atrisk-mail,
Products
| Symfony | 53 | 0 |
| Twig | 25 | 0 |
| Symfony UX | 10 | 0 |
| Html-sanitizer | 5 | 0 |
| Security-http | 4 | 0 |