Sensiolabs Symfony
89 CVEs affecting Sensiolabs Symfony. Latest disclosed: 2026-07-14. Critical: 10, High: 27.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-47767 | Critical | 9.8 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.46 until 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the CVE… |
CVE-2019-18889 | Critical | 9.8 | 2019-11-21 | An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. Serializing certain cache adapter interfaces could resu… |
CVE-2019-11325 | Critical | 9.8 | 2019-11-21 | An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted o… |
CVE-2017-11365 | Critical | 9.8 | 2019-05-23 | Certain Symfony products are affected by: Incorrect Access Control. This affects Symfony 2.7.30 and Symfony 2.8.23 and Symfony 3.2.10 and Symfony 3.3.3. The ty… |
CVE-2019-10913 | Critical | 9.8 | 2019-05-16 | In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the overri… |
CVE-2019-10910 | Critical | 9.8 | 2019-05-16 | In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allo… |
CVE-2018-11407 | Critical | 9.8 | 2018-06-13 | An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0.7. It allows remote… |
CVE-2016-2403 | Critical | 9.8 | 2017-02-07 | Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which trigg… |
CVE-2026-45069 | Critical | 9.1 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, OidcTokenHandler::verify… |
CVE-2026-45063 | Critical | 9.1 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, X509Authenticato… |
CVE-2018-11406 | High | 8.8 | 2018-06-13 | An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x befo… |
CVE-2026-48736 | High | 8.6 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.0 to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, NoPrivateNe… |
CVE-2026-45077 | High | 8.6 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the server:log l… |
CVE-2026-45075 | High | 8.2 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, method-scoped #[IsGranted], #[IsS… |
CVE-2026-45074 | High | 8.1 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.1.0 until 7.4.12 and 8.0.12, Cas2Handler builds the CA… |
CVE-2022-23601 | High | 8.1 | 2022-02-01 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony form component provides a CSRF protection mechani… |
CVE-2019-18887 | High | 8.1 | 2019-11-21 | An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. The UriSigner was subject to timi… |
CVE-2013-4751 | High | 8.1 | 2019-11-01 | php-symfony2-Validator has loss of information during serialization |
CVE-2018-11385 | High | 8.1 | 2018-06-13 | An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x befo… |
CVE-2020-15094 | High | 8.0 | 2020-09-02 | In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests… |