CVE Tools
Track your stack

Symfony

117 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Symfony, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Symfony CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Symfony CVEs per month
MonthCVEs
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-090
2025-100
2025-111
2025-121
2026-011
2026-020
2026-030
2026-040
2026-050
2026-060
2026-0729
2026-080
2026-091
2026-103
2026-1116

Severity

How the 117 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical1010%
  • High3333%
  • Medium5352%
  • Low55%

Latest CVEs

The 15 most recently published vulnerabilities affecting Symfony.

  1. CVE-2026-123824Symfony: XXE (Local File Read) in Config XmlUtils::parse() via validateOnParse = true6.3
  2. CVE-2026-122053Symfony: ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested Objects6.5
  3. CVE-2026-118515Symfony: The Serializer Builds UploadedFile Objects From Request Data, Letting a Client Point an Upload at Any Server File—
  4. CVE-2026-121623Symfony: DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files, Letting a Client Read Any Server File—
  5. CVE-2026-123792Symfony: Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document Hold a Process—
  6. CVE-2026-123339Symfony: Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main Request—
  7. CVE-2026-118514Symfony: HEAD Requests Bypass the methods Option of security.access_control Rules and Firewalls—
  8. CVE-2026-123746Symfony: Programmatic Logins Skip the checkPostAuth() Method of User Checkers—
  9. CVE-2026-121949Symfony: HtmlSanitizer Does Not URL-Sanitize srcset and imagesrcset: Media Scheme and Host Allow-List Bypass5.4
  10. CVE-2026-118517Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority (Incomplete Fix for CVE-2026-45066)4.3
  11. CVE-2026-123125Symfony: Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses allowing SSRF Filter Bypass6.5
  12. CVE-2026-123119Symfony: NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports (Incomplete Fix for CVE-2024-50342)—
  13. CVE-2026-121971Symfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References—
  14. CVE-2026-121373Symfony: HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar (Incomplete Fix for CVE-2026-48761)—
  15. CVE-2026-118516Symfony: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control—

Product grouping is registry-driven, with AI assist and human review. How it works