2095 matches found
CVE-2026-45070
creationtimestamp| type| source ---|---|--- 2026-05-20 13:37:36+00:00| seen| https://bsky.app/profile/symfony.com/post/3mmbzn2gy7z2m 2026-05-20 14:15:12+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mmc3qc4eg22q 2026-07-14 19:58:43+00:00| seen|...
CVE-2026-45133
creationtimestamp| type| source ---|---|--- 2026-05-20 11:01:22+00:00| seen| https://bsky.app/profile/symfony.com/post/3mmbqvocnsc2h 2026-07-14 19:47:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqmxxibpsn2q 2026-07-19 15:37:07+00:00| seen|...
CVE-2026-45069
creationtimestamp| type| source ---|---|--- 2026-05-20 10:58:12+00:00| seen| https://bsky.app/profile/symfony.com/post/3mmbqpbof7o2y 2026-07-14 20:06:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqmyzr2zyk2w 2026-07-16 12:37:06+00:00| seen|...
CVE-2026-46637
creationtimestamp| type| source ---|---|--- 2026-05-20 10:31:39+00:00| seen| https://bsky.app/profile/symfony.com/post/3mmbpakjssk26...
CVE-2026-46628
creationtimestamp| type| source ---|---|--- 2026-05-20 10:31:21+00:00| seen| https://bsky.app/profile/symfony.com/post/3mmbp7zdlyz2b...
CVE-2026-46633
creationtimestamp| type| source ---|---|--- 2026-05-20 10:30:57+00:00| seen| https://bsky.app/profile/symfony.com/post/3mmbp77j3sk2h 2026-06-06 23:55:29+00:00| seen| https://gist.github.com/vladko312/39507beaa58eacf3b62e6a6e6cd69128 2026-06-20 13:22:38+00:00| seen|...
CVE-2026-45075: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
More info at https://symfony.com/cve-2026-45075...
Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation
More info at https://symfony.com/cve-2026-46640...
Astra Linux – Vulnerability in symfony
Symfony is a PHP framework for web and console applications, along with a set of reusable PHP components. The Symfony HTTP cache system functions as a reverse proxy: it caches entire responses including headers and returns them to clients. In a recent change to the AbstractSessionListener,...
Astra Linux – Vulnerability in symfony
Symfony is a PHP framework for web and console applications, along with a set of reusable PHP components. The ability to enumerate users was possible without requiring relevant permissions, as the handling differed depending on whether the user existed or not when attempting to use the “switch...
Astra Linux – Vulnerability in symfony
Symfony is a PHP framework for web and console applications, along with a set of reusable PHP components. When authenticating users, Symfony automatically regenerates the session ID upon login, but preserves the remaining session attributes. Since this does not reset the CSRF tokens upon login, i...
Astra Linux – Vulnerability in symfony
Symfony is a PHP framework for web and console applications, along with a set of reusable PHP components. Starting from versions 2.0.0, 5.0.0, and 6.0.0, and before versions 4.4.51, 5.4.31, and 6.3.8, some Twig filters in CodeExtension used issafe=html, but they did not actually ensure that their...
PT-2026-42361
Drupal core includes a database abstraction API to ensure that queries executed against the database are sanitized to prevent SQL injection attacks. A vulnerability in this API allows an attacker to send specially crafted requests, resulting in arbitrary SQL injection for sites using PostgreSQL...
CVE-2026-41498
Kimai is an open-source time tracking application. Prior to version 2.54.0, the Team API endpoints use IsGranted'editteam' instead of IsGranted'edit', 'team', causing Symfony TeamVoter to abstain from voting. This removes entity-level ownership checks on team operations, allowing any user with th...
GHSA-H4FW-6R7F-W494 Webauthn has a User Verification Downgrade via Default-Open ClientOverridePolicy
Summary In version 5.3.0 of the Symfony bundle, Webauthn\Bundle\Policy\ClientOverridePolicy defaulted to allowing all client overrides, including userVerification. A client could send "userVerification": "discouraged" in the assertion or attestation options request to override a server-configured...
Webauthn has a User Verification Downgrade via Default-Open ClientOverridePolicy
Summary In version 5.3.0 of the Symfony bundle, Webauthn\Bundle\Policy\ClientOverridePolicy defaulted to allowing all client overrides, including userVerification. A client could send "userVerification": "discouraged" in the assertion or attestation options request to override a server-configured...
GHSA-GHC5-95C2-VWCV Auth0 Symfony SDK has Insufficient Entropy in Cookie Encryption
Impact In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected? Consumers are affected if their application meets the following preconditions: - It...
Auth0 Symfony SDK has Insufficient Entropy in Cookie Encryption
Impact In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected? Consumers are affected if their application meets the following preconditions: - It...
Server-Side Template Injection
Craft CMS is vulnerable to Server-Side Template Injection. The vulnerability is due to unsafe exposure of the create Twig function enabling arbitrary object instantiation combined with a Symfony Process gadget chain, which allows an attacker to execute arbitrary code on the server...
