Symfony - Authentication Bypass

Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including 1 no hash or 2 an invalid has...

Symfony HttpFoundation - Access Control Bypass via PATH_INFO

Symfony HttpFoundation component = 2.0.0 and prior to versions 5.4.50, 6.4.29, and 7.3.7 contains an access control bypass vulnerability. The Request class improperly interprets some PATHINFO values, producing URL paths without a leading /. This allows bypassing access control rules that are buil...

badsecrets

badsecrets A pure python library for identifying the use of known or very weak cryptographic secrets across a variety of platforms. The project is designed to be both a repository of various "known secrets" for example, ASP.NET machine keys found in examples in tutorials, and to provide a...

CLSA-2026-1794321899 TuxCare security update for symfony/http-kernel (1 CVE)

TuxCare rebuilt symfony/http-kernel to address 1 CVE. Fixed in v6.4.38-p1+tuxcare...

CLSA-2026-1794321812 TuxCare security update for symfony/http-kernel (1 CVE)

TuxCare rebuilt symfony/http-kernel to address 1 CVE. Fixed in v5.4.51-p1+tuxcare...

CLSA-2026-1794321723 TuxCare security update for symfony/routing (1 CVE)

TuxCare rebuilt symfony/routing to address 1 CVE. Fixed in v7.4.9-p2+tuxcare...

CLSA-2026-1794321633 TuxCare security update for symfony/routing (1 CVE)

TuxCare rebuilt symfony/routing to address 1 CVE. Fixed in v5.4.48-p2+tuxcare...

CLSA-2026-1794321403 TuxCare security update for symfony/validator (2 CVEs)

TuxCare rebuilt symfony/validator to address 2 CVEs. Fixed in v4.4.48-p1+tuxcare...

CLSA-2026-1794321313 TuxCare security update for symfony/http-foundation (1 CVE)

TuxCare rebuilt symfony/http-foundation to address 1 CVE. Fixed in 4.4.49-p4+tuxcare...

CLSA-2026-1794321223 TuxCare security update for symfony/http-foundation (1 CVE)

TuxCare rebuilt symfony/http-foundation to address 1 CVE. Fixed in v7.4.8-p2+tuxcare...

CLSA-2026-1794321137 TuxCare security update for symfony/http-foundation (1 CVE)

TuxCare rebuilt symfony/http-foundation to address 1 CVE. Fixed in v6.4.35-p2+tuxcare...

CLSA-2026-1794321043 TuxCare security update for symfony/http-client (2 CVEs)

TuxCare rebuilt symfony/http-client to address 2 CVEs. Fixed in v6.0.20-p2+tuxcare...

versionscan

versionscan Versionscan is a tool for evaluating your currently installed PHP version and checking it against known CVEs and the versions they were fixed in to report back potential issues. PLEASE NOTE: Work is still in progress to adapt the tool to linux distributions that backport security fixe...

[SECURITY] [DSA 6617-1] symfony security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6617-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 09, 2026 https://www.debian.org/security/faq -...

Symfony Profiler - Remote Access via Injected Arguments

symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the registerargvargc php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by...

UBUNTU-CVE-2026-123339

Improper trust of forwarded headers in RouterListener::onKernelFinishRequest in Symfony HttpKernel versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11 allows a remote attacker to control the host, scheme, and port of absolute URLs generated for the rest of...

CVE-2026-121373

The Symfony HtmlSanitizer component MetaRefreshAttributeSanitizer, introduced to fix CVE-2026-48761, sanitizes the refresh URL of content attributes of meta tags using a regular expression that is too narrow, allowing sanitization to be bypassed, and resulting in potential URL redirection to...

CVE-2026-121971

The component ScopingHttpClient in Symfony HttpClient merges the options of its default scope such as authbearer or authbasic into a request before resolving a relative URL against the baseuri, allowing a network-path reference such as "//evil.example/steal" to be sent to another origin together...

CVE-2026-124479: openemr: OpenEMR before 8.4.0 contains an arbitrary local file read vulnerability in REST document download, where the…

OpenEMR before 8.4.0 contains an arbitrary local file read vulnerability in REST document download, where the controller passes stored uploaded document bytes to Symfony's BinaryFileResponse as a filesystem path instead of returning them as content. Authenticated users with document upload and...

CVE-2026-123339

Improper trust of forwarded headers in RouterListener::onKernelFinishRequest in Symfony HttpKernel versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11 allows a remote attacker to control the host, scheme, and port of absolute URLs generated for the rest of...