High
CVE-2026-45067
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 105
Reset filters
Medium
CVE-2026-45066
Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification
Medium
CVE-2026-45064
Symfony's HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing
Medium
CVE-2026-45065
Symfony has a UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection
High
CVE-2026-45063
Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator
Medium
CVE-2026-24739
Symfony's incorrect argument escaping under MSYS2/Git Bash can lead to destructive file operations on Windows
High
CVE-2025-64500
Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass
High
CVE-2024-51996
Symfony has an Authentication Bypass via RememberMe
High
CVE-2024-51736
Symfony vulnerable to command execution hijack on Windows with Process class
Low
CVE-2024-50345
Symfony vulnerable to open redirect via browser-sanitized URLs
Low
CVE-2024-50343
Symfony has an incorrect response from Validator when input ends with `\n`
Low
CVE-2024-50342
Symfony allows internal address and port enumeration by NoPrivateNetworkHttpClient
Low
CVE-2024-50341
Symfony's `Security::login` does not take into account custom `user_checker`
Medium
CVE-2024-50340
Symfony allows changing the environment through a query
High
ghsa-4vf2-qfg3-7598
symfony/validator XML Entity Expansion vulnerability
High
ghsa-f75p-x5vm-83qp
symfony/translation XML Entity Expansion vulnerability
High
CVE-2014-6072
Symfony Cross-Site Request Forgery vulnerability in the Web Profiler
Medium
ghsa-hx53-jchx-cr52
Symfony2 improper IP based access control
High
ghsa-q2gc-gg3x-7942
Symfony XML Entity Expansion security vulnerability
Critical
ghsa-mmcv-fvq8-r9x3
Symfony XML decoding attack vector through external entities
Medium
ghsa-7mx2-7q8p-pgmw
Symfony may allow a user to switch to using another user's identity
High
CVE-2014-5245
Symfony allows direct access of ESI URLs behind a trusted proxy
Medium
CVE-2015-2309
Symfony has unsafe methods in the Request class
Medium
CVE-2014-6061
Symfony has a security issue when parsing the Authorization header
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.