Symfony/security-core

This hub aggregates every CVE we track for Symfony/security-core, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 5 most recently published vulnerabilities affecting Symfony/security-core.

• CVE-2021-21424Prevent user enumeration using Guard or the new Authenticator-based Security5.3May 13, 2021
• CVE-2017-11365Certain Symfony products are affected by: Incorrect Access Control. This affects Symfony 2.7.30 and Symfony 2.8.23 and Symfony 3.2.10 and Symfony 3.3.3. The type of exploitation is: remote. The com...9.8May 23, 2019
• CVE-2018-11407An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0.7. It allows remote attackers to bypass authentication by...9.8Jun 13, 2018
• CVE-2016-2403Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.9.8Feb 7, 2017
• CVE-2016-1902The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the p...7.5Jun 1, 2016