CVE-2026-49215Symfony UX: CSRF Protection Bypass in symfony/ux-live-component — Accept Header is CORS-Safelisted Exploitation status Not known exploited Fix Affected product U ux Published 07/17/2026 Severity Low CVE-2026-49216Symfony UX: XSS in symfony/ux-autocomplete via unescaped AJAX response data Exploitation status Not known exploited Fix Affected product U ux Published 07/17/2026 Severity Medium CVE-2026-49211Symfony UX: Information exposure via unescaped LIKE wildcards in EntitySearchUtil Exploitation status Not known exploited Fix Affected product U ux Published 07/17/2026 Severity Medium CVE-2026-49208Symfony UX: Format-less date LiveProps parsed with the permissive DateTime constructor Exploitation status Not known exploited Fix Affected product U ux Published 07/17/2026 Severity Medium CVE-2026-49210Symfony UX: XSS in symfony/ux-live-component via attacker-controlled child component tag Exploitation status Not known exploited Fix Affected product U ux Published 07/17/2026 Severity Low CVE-2026-49212Symfony UX: LiveComponentHydrator HMAC checksum lacks component and slot binding Exploitation status Not known exploited Fix Affected product U ux Published 07/17/2026 Severity Medium CVE-2026-49209Symfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requests Exploitation status Not known exploited Fix Affected product U ux Published 07/17/2026 Severity Medium CVE-2026-48807Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters Exploitation status Not known exploited Fix Affected product T Twig Published 07/14/2026 Severity High CVE-2026-48806Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys Exploitation status Not known exploited Fix Affected product T Twig Published 07/14/2026 Severity High CVE-2026-48808Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface` Exploitation status Not known exploited Fix Affected product T Twig Published 07/14/2026 Severity Medium CVE-2026-48805Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php` Exploitation status Not known exploited Fix Affected product T Twig Published 07/14/2026 Severity Medium CVE-2026-49981Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template` Exploitation status Not known exploited Fix Affected product T Twig Published 07/14/2026 Severity Medium CVE-2026-46637Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']` Exploitation status Not known exploited Fix Affected product T Twig Published 07/14/2026 Severity Medium CVE-2026-46638Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411) Exploitation status Not known exploited Fix Affected product T Twig Published 07/14/2026 Severity Medium CVE-2026-46640Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation Exploitation status Not known exploited Fix Affected product T Twig Published 07/14/2026 Severity High CVE-2026-46629Twig: Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments Exploitation status Not known exploited Fix Affected product T Twig Published 07/14/2026 Severity Medium CVE-2026-47730Twig: XSS in profiler HtmlDumper via unescaped template and profile names Exploitation status Not known exploited Fix Affected product T Twig Published 07/14/2026 Severity Medium CVE-2026-46628Twig: The `spaceless` filter implicitly marks its output as safe Exploitation status Public exploit Fix Affected product T Twig Published 07/14/2026 Severity Medium CVE-2026-46634Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name Exploitation status Not known exploited Fix Affected product T Twig Published 07/14/2026 Severity High CVE-2026-46627Twig: Sandbox resource exhaustion via unbounded `for` / `range()` Exploitation status Not known exploited Fix Not confirmed Affected product T Twig Published 07/14/2026 Severity High CVE-2026-46633Twig: PHP code injection via `{% use %}` template name Exploitation status Not known exploited Fix Affected product T Twig Published 07/14/2026 Severity High CVE-2026-46639Twig: Sandbox property and method bypass via object-destructuring assignment Exploitation status Not known exploited Fix Affected product T Twig Published 07/14/2026 Severity High CVE-2026-46635Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects) Exploitation status Not known exploited Fix Affected product T Twig Published 07/14/2026 Severity Medium CVE-2026-47732Twig Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points Exploitation status Not known exploited Fix Affected product T Twig Published 07/14/2026 Severity High CVE-2026-46644symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence Exploitation status Not known exploited Fix Affected product P polyfill Published 07/14/2026 Severity Medium CVE-2026-48761Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> content Exploitation status Not known exploited Fix Affected product S symfony Published 07/14/2026 Severity Medium CVE-2026-48747Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade Exploitation status Not known exploited Fix Affected product S symfony Published 07/14/2026 Severity Medium CVE-2026-48489Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes Exploitation status Not known exploited Fix Affected product S symfony Published 07/14/2026 Severity High CVE-2026-48760Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense Exploitation status Not known exploited Fix Affected product S symfony Published 07/14/2026 Severity Medium CVE-2026-48736Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient Exploitation status Not known exploited Fix Affected product S symfony Published 07/14/2026 Severity Medium CVE-2026-48784Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization Exploitation status Not known exploited Fix Affected product S symfony Published 07/14/2026 Severity Medium CVE-2026-45068Symfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address Exploitation status Not known exploited Fix Affected product S symfony Published 07/14/2026 Severity High CVE-2026-47212Symfony: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event Injection Exploitation status Not known exploited Fix Affected product S symfony Published 07/14/2026 Severity Medium CVE-2026-45071Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true Exploitation status Not known exploited Fix Affected product S symfony Published 07/14/2026 Severity High CVE-2026-45755Symfony: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection Exploitation status Not known exploited Fix Affected product S symfony Published 07/14/2026 Severity Medium CVE-2026-45754Symfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection Exploitation status Not known exploited Fix Affected product S symfony Published 07/14/2026 Severity Medium CVE-2026-45305Symfony: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex Exploitation status Not known exploited Fix Affected product S symfony Published 07/14/2026 Severity High CVE-2026-45304Symfony: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs") Exploitation status Not known exploited Fix Affected product S symfony Published 07/14/2026 Severity High CVE-2026-45069Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims Exploitation status Not known exploited Fix Affected product S symfony Published 07/14/2026 Severity High CVE-2026-45133Symfony: [Yaml] Harden the parser when handling untrusted input Exploitation status Not known exploited Fix Affected product S symfony Published 07/14/2026 Severity High CVE-2026-45075Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid] Exploitation status Not known exploited Fix Affected product S symfony Published 07/14/2026 Severity High CVE-2026-47767Symfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch Exploitation status Not known exploited Fix Affected product S symfony Published 07/14/2026 Severity High CVE-2026-45064Symfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing Exploitation status Not known exploited Fix Affected product S symfony Published 07/14/2026 Severity Low CVE-2026-45063Symfony: Identity Spoofing via Unanchored DN Regex in X509Authenticator Exploitation status Not known exploited Fix Affected product S symfony Published 07/14/2026 Severity Critical CVE-2026-45070Symfony: Email Header Injection via Non-Token Characters in Mime Parameter Names Exploitation status Not known exploited Fix Affected product S symfony Published 07/14/2026 Severity Medium CVE-2026-45073Symfony: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix Exploitation status Not known exploited Fix Affected product S symfony Published 07/14/2026 Severity Medium CVE-2026-45753Symfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS) Exploitation status Not known exploited Fix Affected product S symfony Published 07/14/2026 Severity Low CVE-2026-45072Symfony: Stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering Exploitation status Not known exploited Fix Affected product S symfony Published 07/14/2026 Severity Low CVE-2026-45756Symfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS Exploitation status Not known exploited Fix Affected product S symfony Published 07/14/2026 Severity High CVE-2026-45066Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification Exploitation status Not known exploited Fix Affected product S symfony Published 07/14/2026 Severity Low CVE-2026-45074Symfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay Exploitation status Not known exploited Fix Affected product S symfony Published 07/14/2026 Severity High CVE-2026-45077Symfony: Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener Exploitation status Not known exploited Fix Affected product S symfony Published 07/14/2026 Severity High CVE-2026-45065Symfony: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection Exploitation status Not known exploited Fix Affected product S symfony Published 07/14/2026 Severity Low CVE-2026-45067Symfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address Exploitation status Not known exploited Fix Not confirmed Affected product S symfony Published 07/14/2026 Severity Medium CVE-2026-55877Symfony UX: XSS in symfony/ux-icons via unsanitized SVG content in local files and Iconify on-demand responses Exploitation status Not known exploited Fix Affected product U ux Published 07/08/2026 Severity Medium CVE-2026-55878Symfony: Path Traversal in symfony/ux-toolkit Allows Arbitrary File Write and Read via Crafted Recipe Manifest Exploitation status Not known exploited Fix Affected product U ux Published 07/08/2026 Severity High CVE-2026-24425Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface Exploitation status Not known exploited Fix Affected product T Twig Published 05/20/2026 Severity High CVE-2026-24739Symfony has incorrect argument escaping under MSYS2/Git Bash on Windows that can lead to destructive file operations Exploitation status Not known exploited Fix Not confirmed Affected product S symfony Published 01/28/2026 Severity Medium CVE-2025-64500Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass Exploitation status Not known exploited Fix Not confirmed Affected product S symfony Published 11/12/2025 Severity High CVE-2025-47946symfony/ux-live-component and symfony/ux-twig-component vulnerable to unsanitized HTML attribute injection via ComponentAttributes Exploitation status Not known exploited Fix Affected product U ux Published 05/19/2025 Severity Medium CVE-2024-51996Symphony has an Authentication Bypass via RememberMe Exploitation status Not known exploited Fix Affected product S symfony Published 11/13/2024 Severity High CVE-2024-50340Ability to change environment from query in symfony/runtime Exploitation status Not known exploited Fix Not confirmed Affected product S symfony Published 11/06/2024 Severity High CVE-2024-50341Security::login does not take into account custom user_checker in symfony/security-bundle Exploitation status Not known exploited Fix Not confirmed Affected product S symfony Published 11/06/2024 Severity Low CVE-2024-50342Internal address and port enumeration allowed by NoPrivateNetworkHttpClient in symfony/http-client Exploitation status Not known exploited Fix Not confirmed Affected product S symfony Published 11/06/2024 Severity Low CVE-2024-50343Incorrect response from Validator when input ends with `\n` in symfony/validator Exploitation status Not known exploited Fix Not confirmed Affected product S symfony Published 11/06/2024 Severity Low CVE-2024-50345Open redirect via browser-sanitized URLs in symfony/http-foundation Exploitation status Not known exploited Fix Affected product S symfony Published 11/06/2024 Severity Low CVE-2024-51736Command execution hijack on Windows with Process class in symfony/process Exploitation status Not known exploited Fix Not confirmed Affected product S symfony Published 11/06/2024 Severity Informational CVE-2024-45411Twig has a possible sandbox bypass Exploitation status Not known exploited Fix Affected product T Twig Published 09/09/2024 Severity High CVE-2023-46735Symfony potential Cross-site Scripting in WebhookController Exploitation status Not known exploited Fix Not confirmed Affected product S symfony Published 11/10/2023 Severity Medium CVE-2023-46734Symfony potential Cross-site Scripting vulnerabilities in CodeExtension filters Exploitation status Not known exploited Fix Not confirmed Affected product S symfony Published 11/10/2023 Severity Medium CVE-2023-46733Symfony possible session fixation vulnerability Exploitation status Not known exploited Fix Not confirmed Affected product S symfony Published 11/10/2023 Severity Medium CVE-2023-41336Prevent injection of invalid entity ids for "autocomplete" fields in symfony ux-autocomplete Exploitation status Not known exploited Fix Not confirmed Affected product U ux-autocomplete Published 09/11/2023 Severity Medium CVE-2022-24894Symfony storing cookie headers in HttpCache Exploitation status Not known exploited Fix Not confirmed Affected product S symfony Published 02/03/2023 Severity Medium CVE-2022-24895Symfony vulnerable to Session Fixation of CSRF tokens Exploitation status Not known exploited Fix Affected product S symfony Published 02/03/2023 Severity Medium CVE-2022-39261Twig may load a template outside a configured directory when using the filesystem loader Exploitation status Not known exploited Fix Not confirmed Affected product T Twig Published 09/28/2022 Severity High CVE-2022-23614Code injection in Twig Exploitation status Not known exploited Fix Not confirmed Affected product T Twig Published 02/04/2022 Severity High CVE-2022-23601CSRF token missing in Symfony Exploitation status Not known exploited Fix Affected product S symfony Published 02/01/2022 Severity High CVE-2021-41270CSV Injection in Symfony Exploitation status Not confirmed Fix Not confirmed Affected product S symfony Published 11/24/2021 Severity Medium CVE-2021-41267Webcache Poisoning in Symfony Exploitation status Not confirmed Fix Not confirmed Affected product S symfony Published 11/24/2021 Severity Medium CVE-2021-41268Cookie persistence in Symfony Exploitation status Not confirmed Fix Not confirmed Affected product S symfony Published 11/24/2021 Severity Medium CVE-2021-32693Authentication granted with multiple firewalls Exploitation status Not confirmed Fix Not confirmed Affected product S symfony Published 06/17/2021 Severity Medium CVE-2021-21424Prevent user enumeration using Guard or the new Authenticator-based Security Exploitation status Not confirmed Fix Not confirmed Affected product S symfony Published 05/13/2021 Severity Medium CVE-2020-15094RCE in Symfony Exploitation status Not confirmed Fix Affected product S symfony Published 09/02/2020 Severity High CVE-2020-5275Firewall configured with unanimous strategy was not actually unanimous in symfony/security-http Exploitation status Not confirmed Fix Affected product S symfony Published 03/30/2020 Severity High CVE-2020-5274Exceptions displayed in non-debug configurations in Symfony Exploitation status Not confirmed Fix Affected product S symfony Published 03/30/2020 Severity Medium CVE-2020-5255Prevent cache poisoning via a Response Content-Type header Exploitation status Not confirmed Fix Affected product S symfony Published 03/30/2020 Severity Low CVE-2019-9942Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 03/23/2019 Severity Unknown CVE-2018-13818Exploitation status Public exploit Fix Not confirmed Affected product Not confirmed Published 07/10/2018 Severity Unknown CVE-2015-7809Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 11/06/2015 Severity Unknown CVE-2001-1537Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 07/14/2005 Severity Unknown 
