Known vulnerabilities in Symfony

Vendor: SensioLabs
Software: Symfony
Software CPE: cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*
Total vulnerabilities: 88
Public exploits: 1
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Symfony Symfony is affected by 88 known vulnerabilities: 14 high, 51 medium, 23 low Critical High Medium Low

Vulnerabilities (88)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU133285 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-48761
CWE-79 Low
No
No
6.4.41, 7.4.13, 8.0.13 03.06.2026 SB2026060306
SB2026060316
#VU133122 - URL Redirection to Untrusted Site ('Open Redirect')
CVE-2026-48784
CWE-601 Medium
No
No
5.4.53, 6.4.41, 7.4.13, 8.0.13 01.06.2026 SB2026060135
SB2026060202
SB2026060316
#VU133119 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)
CVE-2026-48760
CWE-451 Medium
No
No
6.4.41, 7.4.13, 8.0.13 01.06.2026 SB2026060135
SB2026060316
#VU133117 - Improper Verification of Cryptographic Signature
CVE-2026-48747
CWE-347 Medium
No
No
7.4.13, 8.0.13 01.06.2026 SB2026060135
#VU133113 - Server-Side Request Forgery (SSRF)
CVE-2026-48736
CWE-918 Medium
No
No
5.4.53, 6.4.41, 7.4.13, 8.0.13 01.06.2026 SB2026060135
SB2026060202
SB2026060316
#VU133111 - Incorrect Authorization
CVE-2026-48489
CWE-863 Medium
No
No
5.4.53, 6.4.41, 7.4.13, 8.0.13 01.06.2026 SB2026060135
SB2026060202
SB2026060316
#VU132075 - Uncontrolled Recursion
CVE-2026-45133
CWE-674 Medium
No
No
5.4.52, 6.4.40, 7.4.12, 8.0.12 21.05.2026 SB2026052131
SB2026060202
SB2026060316
#VU132065 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2026-45071
CWE-611 Medium
No
No
5.4.52, 6.4.40, 7.4.12, 8.0.12 21.05.2026 SB2026052131
SB2026060202
SB2026060316
#VU132064 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-45073
CWE-89 Low
No
No
5.4.52, 6.4.40, 7.4.12, 8.0.12 21.05.2026 SB2026052131
SB2026060202
SB2026060316
#VU132063 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)
CVE-2026-45064
CWE-451 Low
No
No
6.4.40, 7.4.12, 8.0.12 21.05.2026 SB2026052131
SB2026060316
#VU132062 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVE-2026-45070
CWE-93 Medium
No
No
5.4.52, 6.4.40, 7.4.12, 8.0.12 21.05.2026 SB2026052131
#VU132061 - Deserialization of Untrusted Data
CVE-2026-45077
CWE-502 High
No
No
5.4.52, 6.4.40, 7.4.12, 8.0.12 21.05.2026 SB2026052131
SB2026060202
SB2026060316
#VU132060 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
CVE-2026-45304
CWE-776 Medium
No
No
5.4.52, 6.4.40, 7.4.12, 8.0.12 21.05.2026 SB2026052131
SB2026060202
SB2026060316
#VU132059 - Inefficient Regular Expression Complexity
CVE-2026-45305
CWE-1333 Medium
No
No
5.4.52, 6.4.40, 7.4.12, 8.0.12 21.05.2026 SB2026052131
SB2026060202
SB2026060316
#VU132058 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-45753
CWE-79 Medium
No
No
6.4.40, 7.4.12, 8.0.12 21.05.2026 SB2026052131
#VU132057 - Missing Authentication for Critical Function
CVE-2026-45754
CWE-306 Medium
No
No
6.4.40, 7.4.12, 8.0.12 21.05.2026 SB2026052131
SB2026060316
#VU132056 - Improper Verification of Cryptographic Signature
CVE-2026-45755
CWE-347 Medium
No
No
7.4.12, 8.0.12 21.05.2026 SB2026052131
#VU132055 - Inefficient Regular Expression Complexity
CVE-2026-45756
CWE-1333 Medium
No
No
7.4.12, 8.0.12 21.05.2026 SB2026052131
#VU132054 - Improper Verification of Cryptographic Signature
CVE-2026-47212
CWE-347 Medium
No
No
6.4.40, 7.4.12, 8.0.12 21.05.2026 SB2026052131
#VU132053 - Interpretation Conflict
CVE-2026-46626
CWE-436 Medium
No
No
5.4.52, 6.4.40, 7.4.12, 8.0.12 21.05.2026 SB2026052131
SB2026060202
SB2026060316


Showing elements 1 - 20 out of 88