Symfony/symfony
71 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Symfony/symfony, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Symfony/symfony CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 5 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 1 |
| 2025-12 | 0 |
| 2026-01 | 1 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 71 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical7
- High18
- Medium29
- Low4
Latest CVEs
The 15 most recently published vulnerabilities affecting Symfony/symfony.
- CVE-2026-24739Symfony has incorrect argument escaping under MSYS2/Git Bash on Windows that can lead to destructive file operations6.3
- CVE-2025-64500Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass7.3
- CVE-2024-50340Ability to change environment from query in symfony/runtime7.3
- CVE-2024-50341Security::login does not take into account custom user_checker in symfony/security-bundle3.1
- CVE-2024-50342Internal address and port enumeration allowed by NoPrivateNetworkHttpClient in symfony/http-client3.1
- CVE-2024-50343Incorrect response from Validator when input ends with `\n` in symfony/validator3.1
- CVE-2024-51736Command execution hijack on Windows with Process class in symfony/process—
- CVE-2014-6072Symfony Cross-Site Request Forgery vulnerability in the Web Profiler—
- GHSA-hx53-jchx-cr52Symfony2 improper IP based access control—
- GHSA-q2gc-gg3x-7942Symfony XML Entity Expansion security vulnerability—
- GHSA-mmcv-fvq8-r9x3Symfony XML decoding attack vector through external entities—
- GHSA-7mx2-7q8p-pgmwSymfony may allow a user to switch to using another user's identity—
- CVE-2014-5245Symfony allows direct access of ESI URLs behind a trusted proxy—
- CVE-2015-2309Symfony has unsafe methods in the Request class—
- CVE-2014-6061Symfony has a security issue when parsing the Authorization header—
Product grouping is registry-driven, with AI assist and human review. How it works