# cve.now: Symfony

The newest entries naming Symfony as an affected vendor (up to 200), of 66 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-118514](https://cve.now/CVE-2026-118514.md): Symfony: HEAD Requests Bypass the methods Option of security.access\_control Rules and Firewalls (CVSS 6.3)
- [CVE-2026-49215](https://cve.now/CVE-2026-49215.md): Symfony UX: CSRF Protection Bypass in symfony/ux-live-component — Accept Header is CORS-Safelisted (CVSS 2.1)
- [CVE-2026-49216](https://cve.now/CVE-2026-49216.md): Symfony UX: XSS in symfony/ux-autocomplete via unescaped AJAX response data (CVSS 5.1)
- [CVE-2026-49211](https://cve.now/CVE-2026-49211.md): Symfony UX: Information exposure via unescaped LIKE wildcards in EntitySearchUtil (CVSS 6.9)
- [CVE-2026-49208](https://cve.now/CVE-2026-49208.md): Symfony UX: Format-less date LiveProps parsed with the permissive DateTime constructor (CVSS 6.9)
- [CVE-2026-49210](https://cve.now/CVE-2026-49210.md): Symfony UX: XSS in symfony/ux-live-component via attacker-controlled child component tag (CVSS 2.3)
- [CVE-2026-49212](https://cve.now/CVE-2026-49212.md): Symfony UX: LiveComponentHydrator HMAC checksum lacks component and slot binding (CVSS 6.9)
- [CVE-2026-49209](https://cve.now/CVE-2026-49209.md): Symfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requests (CVSS 5.3)
- [CVE-2026-46644](https://cve.now/CVE-2026-46644.md): symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence (CVSS 6.9)
- [CVE-2026-48761](https://cve.now/CVE-2026-48761.md): Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on \<object\>, \<applet\>, \<iframe\>, \<img\> and the URL Inside \<meta http-equiv="refresh"\> content (CVSS 5.3)
- [CVE-2026-48747](https://cve.now/CVE-2026-48747.md): Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade (CVSS 6.3)
- [CVE-2026-48489](https://cve.now/CVE-2026-48489.md): Symfony: Security Firewall Bypass via failure\_forward Subrequest: Unauthenticated Access to access\_control-Protected GET Routes (CVSS 8.7)
- [CVE-2026-48760](https://cve.now/CVE-2026-48760.md): Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense (CVSS 5.3)
- [CVE-2026-48736](https://cve.now/CVE-2026-48736.md): Symfony: IpUtils::PRIVATE\_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient (CVSS 6.9)
- [CVE-2026-48784](https://cve.now/CVE-2026-48784.md): Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained \`../\` or \`./\` → Generated URL Collapses Off-Route Under RFC 3986 Normalization (CVSS 5.1)
- [CVE-2026-45068](https://cve.now/CVE-2026-45068.md): Symfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address (CVSS 8.7)
- [CVE-2026-47212](https://cve.now/CVE-2026-47212.md): Symfony: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event Injection (CVSS 6.9)
- [CVE-2026-45071](https://cve.now/CVE-2026-45071.md): Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true (CVSS 8.7)
- [CVE-2026-45755](https://cve.now/CVE-2026-45755.md): Symfony: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection (CVSS 6.9)
- [CVE-2026-45754](https://cve.now/CVE-2026-45754.md): Symfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection (CVSS 6.9)
- [CVE-2026-45305](https://cve.now/CVE-2026-45305.md): Symfony: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex (CVSS 8.7)
- [CVE-2026-45304](https://cve.now/CVE-2026-45304.md): Symfony: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs") (CVSS 8.7)
- [CVE-2026-45069](https://cve.now/CVE-2026-45069.md): Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims (CVSS 8.8)
- [CVE-2026-45133](https://cve.now/CVE-2026-45133.md): Symfony: \[Yaml\] Harden the parser when handling untrusted input (CVSS 8.2)
- [CVE-2026-45075](https://cve.now/CVE-2026-45075.md): Symfony: HEAD Request Bypasses methods: \['GET'\] Filter in #\[IsGranted\] / #\[IsSignatureValid\] / #\[IsCsrfTokenValid\] (CVSS 8.3)
- [CVE-2026-47767](https://cve.now/CVE-2026-47767.md): Symfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP\_ENV/APP\_DEBUG via parse\_str/SAPI Argv Mismatch (CVSS 8.3)
- [CVE-2026-45064](https://cve.now/CVE-2026-45064.md): Symfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing (CVSS 2.3)
- [CVE-2026-45063](https://cve.now/CVE-2026-45063.md): Symfony: Identity Spoofing via Unanchored DN Regex in X509Authenticator (CVSS 9.1)
- [CVE-2026-45070](https://cve.now/CVE-2026-45070.md): Symfony: Email Header Injection via Non-Token Characters in Mime Parameter Names (CVSS 6.3)
- [CVE-2026-45073](https://cve.now/CVE-2026-45073.md): Symfony: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix (CVSS 6.3)
- [CVE-2026-45753](https://cve.now/CVE-2026-45753.md): Symfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS) (CVSS 2.1)
- [CVE-2026-45072](https://cve.now/CVE-2026-45072.md): Symfony: Stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering (CVSS 2.0)
- [CVE-2026-45756](https://cve.now/CVE-2026-45756.md): Symfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS (CVSS 8.2)
- [CVE-2026-45066](https://cve.now/CVE-2026-45066.md): Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and \<area\> Misclassification (CVSS 2.3)
- [CVE-2026-45074](https://cve.now/CVE-2026-45074.md): Symfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay (CVSS 7.6)
- [CVE-2026-45077](https://cve.now/CVE-2026-45077.md): Symfony: Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener (CVSS 8.3)
- [CVE-2026-45065](https://cve.now/CVE-2026-45065.md): Symfony: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection (CVSS 2.3)
- [CVE-2026-45067](https://cve.now/CVE-2026-45067.md): Symfony: Email Header / SMTP Command Injection via CRLF in Symfony\\Component\\Mime\\Address (CVSS 6.3)
- [CVE-2026-55877](https://cve.now/CVE-2026-55877.md): Symfony UX: XSS in symfony/ux-icons via unsanitized SVG content in local files and Iconify on-demand responses (CVSS 6.1)
- [CVE-2026-55878](https://cve.now/CVE-2026-55878.md): Symfony: Path Traversal in symfony/ux-toolkit Allows Arbitrary File Write and Read via Crafted Recipe Manifest (CVSS 7.8)
- [CVE-2026-24739](https://cve.now/CVE-2026-24739.md): Symfony has incorrect argument escaping under MSYS2/Git Bash on Windows that can lead to destructive file operations (CVSS 6.3)
- [CVE-2025-64500](https://cve.now/CVE-2025-64500.md): Symfony's incorrect parsing of PATH\_INFO can lead to limited authorization bypass (CVSS 7.3)
- [CVE-2025-47946](https://cve.now/CVE-2025-47946.md): symfony/ux-live-component and symfony/ux-twig-component vulnerable to unsanitized HTML attribute injection via ComponentAttributes (CVSS 6.1)
- [CVE-2024-51996](https://cve.now/CVE-2024-51996.md): Symphony has an Authentication Bypass via RememberMe (CVSS 7.5)
- [CVE-2024-50340](https://cve.now/CVE-2024-50340.md): Ability to change environment from query in symfony/runtime (CVSS 7.3)
- [CVE-2024-50341](https://cve.now/CVE-2024-50341.md): Security::login does not take into account custom user\_checker in symfony/security-bundle (CVSS 3.1)
- [CVE-2024-50342](https://cve.now/CVE-2024-50342.md): Internal address and port enumeration allowed by NoPrivateNetworkHttpClient in symfony/http-client (CVSS 3.1)
- [CVE-2024-50343](https://cve.now/CVE-2024-50343.md): Incorrect response from Validator when input ends with \`\\n\` in symfony/validator (CVSS 3.1)
- [CVE-2024-50345](https://cve.now/CVE-2024-50345.md): Open redirect via browser-sanitized URLs in symfony/http-foundation (CVSS 3.1)
- [CVE-2024-51736](https://cve.now/CVE-2024-51736.md): Command execution hijack on Windows with Process class in symfony/process (CVSS 0.0)
- [CVE-2023-46735](https://cve.now/CVE-2023-46735.md): Symfony potential Cross-site Scripting in WebhookController (CVSS 6.1)
- [CVE-2023-46734](https://cve.now/CVE-2023-46734.md): Symfony potential Cross-site Scripting vulnerabilities in CodeExtension filters (CVSS 6.1)
- [CVE-2023-46733](https://cve.now/CVE-2023-46733.md): Symfony possible session fixation vulnerability (CVSS 6.5)
- [CVE-2023-41336](https://cve.now/CVE-2023-41336.md): Prevent injection of invalid entity ids for "autocomplete" fields in symfony ux-autocomplete (CVSS 6.5)
- [CVE-2022-24894](https://cve.now/CVE-2022-24894.md): Symfony storing cookie headers in HttpCache (CVSS 5.9)
- [CVE-2022-24895](https://cve.now/CVE-2022-24895.md): Symfony vulnerable to Session Fixation of CSRF tokens (CVSS 6.3)
- [CVE-2022-23601](https://cve.now/CVE-2022-23601.md): CSRF token missing in Symfony (CVSS 8.1)
- [CVE-2021-41270](https://cve.now/CVE-2021-41270.md): CSV Injection in Symfony (CVSS 6.5)
- [CVE-2021-41267](https://cve.now/CVE-2021-41267.md): Webcache Poisoning in Symfony (CVSS 6.5)
- [CVE-2021-41268](https://cve.now/CVE-2021-41268.md): Cookie persistence in Symfony (CVSS 6.5)
- [CVE-2021-32693](https://cve.now/CVE-2021-32693.md): Authentication granted with multiple firewalls (CVSS 6.8)
- [CVE-2021-21424](https://cve.now/CVE-2021-21424.md): Prevent user enumeration using Guard or the new Authenticator-based Security (CVSS 5.3)
- [CVE-2020-15094](https://cve.now/CVE-2020-15094.md): RCE in Symfony (CVSS 8.0)
- [CVE-2020-5275](https://cve.now/CVE-2020-5275.md): Firewall configured with unanimous strategy was not actually unanimous in symfony/security-http (CVSS 7.6)
- [CVE-2020-5274](https://cve.now/CVE-2020-5274.md): Exceptions displayed in non-debug configurations in Symfony (CVSS 4.6)
- [CVE-2020-5255](https://cve.now/CVE-2020-5255.md): Prevent cache poisoning via a Response Content-Type header (CVSS 2.6)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/symfony
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.