Vendor
Symfony vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 59 vulnerabilities in Symfony: 9 in the last 7 days and 20 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-121619, was published on 12 November 2026. 19 vulnerabilities in the last four weeks, up from none in the four before. 7 technologies have a page of their own.
- Last 7 days
- 9
- Last 90 days
- 20
- Critical, all time
- 0
- Exploited in the wild
- 0
About Symfony
A software project and organization focused on PHP development and the Symfony framework.
Symfony technologies
Latest Symfony vulnerabilities
- CVE-2026-121619: Symfony FrameworkBundle IP spoofing via trusted_proxiesinfo
- CVE-2026-123824: Symfony Config XmlUtils XML external entity injectioninfo
- CVE-2026-122053: Symfony Serializer ObjectNormalizer property traversal bypassinfo
- CVE-2026-118515: Symfony Serializer arbitrary file handling via DataUriNormalizerinfo
- CVE-2026-123792: Symfony Yaml component ReDoS in parser and inlineinfo
- CVE-2026-121623: Symfony Serializer DataUriNormalizer path traversalinfo
- CVE-2026-123339: Symfony HttpKernel improper trust of forwarded headersinfo
- CVE-2026-118514: Symfony http-foundation HTTP method matching bypassinfo
- CVE-2026-123746: Symfony Security HTTP component post-authentication user checker bypassinfo
- CVE-2026-121949: Symfony HtmlSanitizer media URL policy bypass in srcset attributesinfo
- CVE-2026-118517: Symfony HtmlSanitizer UrlSanitizer host allowlist bypassmediumCVSS 4.3
- CVE-2026-123125: Symfony Validator IpValidator SSRF in internal address filteringinfo
- CVE-2026-123119: Symfony HttpClient NoPrivateNetworkHttpClient DNS rebinding in cached hostsinfo
- CVE-2026-121971: Symfony HttpClient credential disclosure via URL overrideinfo
- CVE-2026-121373: Symfony HtmlSanitizer meta refresh URL sanitization bypassinfo
- CVE-2026-118516: Symfony Routing host-path interpretation bypass in UrlMatcherinfo
- CVE-2026-118513: Symfony X509 authentication bypass by certificate CN spoofinginfo
- CVE-2026-109449: Symfony Expression Language unbounded parser depth denial of serviceinfoEPSS 0.5%
- CVE-2026-109413: Symfony YAML stack exhaustion in inline lexerhighCVSS 4EPSS 0.4%
- CVE-2026-108082: Symfony HTTP Foundation ReDoS in HeaderUtils::split()highCVSS 4EPSS 0.5%
- CVE-2026-49216: Symfony UX Autocomplete XSS via unescaped AJAX response datamediumCVSS 4EPSS 0.3%
- CVE-2026-49215: Symfony UX LiveComponent CSRF in LiveAction invocationsmediumCVSS 4EPSS 0.2%
- CVE-2026-49212: Symfony UX insufficient verification of data authenticity in LiveComponentmediumCVSS 4EPSS 0.2%
- CVE-2026-49211: Symfony UX Autocomplete information exposure via unescaped LIKE wildcardsmediumCVSS 4EPSS 0.5%
- CVE-2026-49210: Symfony UX LiveComponent XSS via unvalidated child component tagmediumCVSS 4EPSS 0.3%
Most severe Symfony vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-55878: Symfony UX Toolkit path traversal in ux:install commandhighCVSS 7.8EPSS 0.2%
- CVE-2026-45077: Symfony MonologBridge PHP deserialization in server:log listenerhighCVSS 4EPSS 0.7%
- CVE-2026-45067: Symfony Mime CRLF injection in Address constructorhighCVSS 4EPSS 0.6%
- CVE-2026-108082: Symfony HTTP Foundation ReDoS in HeaderUtils::split()highCVSS 4EPSS 0.5%
- CVE-2026-109413: Symfony YAML stack exhaustion in inline lexerhighCVSS 4EPSS 0.4%
- CVE-2026-45063: Symfony X509Authenticator authentication bypass via spoofinghighCVSS 4EPSS 0.4%
- CVE-2026-48489: Symfony firewall bypass via failure_forward subrequest in security-httphighCVSS 0EPSS 0.6%
- CVE-2026-45065: Symfony open redirect in UrlGenerator route validationmediumCVSS 6.1EPSS 0.4%
- CVE-2026-55877: Symfony UX Icons cross-site scripting via unsanitized SVG contentmediumCVSS 6.1EPSS 0.3%
- CVE-2026-118517: Symfony HtmlSanitizer UrlSanitizer host allowlist bypassmediumCVSS 4.3
Vulnerabilities per week
19 vulnerabilities in the last four weeks, up from none in the four before. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 3 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 16 | 0 | |
| 9 Nov 2026 | 1 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Symfony vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/symfony)<a href="https://junglewise.ai/threats/vendors/symfony"><img src="https://junglewise.ai/threats/vendors/symfony/badge.svg" alt="Symfony vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/symfony.json, and this page as text at https://junglewise.ai/threats/vendors/symfony.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Symfony vulnerabilities", https://junglewise.ai/threats/vendors/symfony, 12 November 2026.