Vulnerabilities in symfony
65 resultsVexday analysis
O Symfony apresenta um volume significativo de 65 CVEs catalogadas, com 39 publicadas nos últimos 90 dias, indicando vulnerabilidades recentes e contínuas. A fraqueza dominante é XSS (CWE-79), típica de frameworks web, embora apenas 1 seja crítica e nenhuma esteja sob ataque ativo no momento. O risco atual é moderado, mas demanda atenção ao padrão de descobertas recentes para detecção de novos exploits.
CVE-2026-45756HIGHSymfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoSEPSS 0.6%CVE-2023-46735MEDIUMSymfony potential Cross-site Scripting in WebhookControllerEPSS 0.6%CVE-2022-23601HIGHCSRF token missing in SymfonyEPSS 0.6%CVE-2024-50345LOWOpen redirect via browser-sanitized URLs in symfony/http-foundationEPSS 0.6%CVE-2023-41336MEDIUMPrevent injection of invalid entity ids for "autocomplete" fields in symfony ux-autocompleteEPSS 0.5%CVE-2024-50342LOWInternal address and port enumeration allowed by NoPrivateNetworkHttpClient in symfony/http-clientEPSS 0.5%CVE-2026-48489HIGHSymfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET RoutesEPSS 0.5%CVE-2024-50343LOWIncorrect response from Validator when input ends with `\n` in symfony/validatorEPSS 0.5%CVE-2026-45071HIGHSymfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = trueEPSS 0.5%CVE-2026-48736MEDIUMSymfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClientEPSS 0.5%CVE-2026-45077HIGHSymfony: Unauthenticated PHP Object Deserialization in MonologBridge server:log ListenerEPSS 0.4%CVE-2024-51736NONECommand execution hijack on Windows with Process class in symfony/processEPSS 0.4%CVE-2026-45074HIGHSymfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket ReplayEPSS 0.4%CVE-2026-45073MEDIUMSymfony: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefixEPSS 0.4%CVE-2026-45068HIGHSymfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient AddressEPSS 0.4%CVE-2026-46644MEDIUMsymfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalenceEPSS 0.4%CVE-2026-47767HIGHSymfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv MismatchEPSS 0.4%CVE-2026-45075HIGHSymfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]EPSS 0.4%CVE-2026-45754MEDIUMSymfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event InjectionEPSS 0.3%CVE-2026-45063CRITICALSymfony: Identity Spoofing via Unanchored DN Regex in X509AuthenticatorEPSS 0.3%