Skip to content
Noroxi

symfony records

36 published records for vendor symfony.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
3
With a fix record
94.4%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18
  2. 19
  3. 22
  4. 23
  5. 24
  6. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

36 records
  • CVE-2022-23614
    41Plan

    Code injection in Twig

    CriticalCVSS 9.8Proof of conceptEPSS 8%

    symfony · twigFeb 4, 2022

  • CVE-2018-13818
    41Plan

    Twig before 2.4.4 allows Server-Side Template Injection (SSTI) via the search search_key parameter.

    CriticalCVSS 9.8No exploitEPSS 6%

    symfony · twigJul 10, 2018

  • CVE-2024-45411
    34Monitor

    Twig has a possible sandbox bypass

    HighCVSS 8.6No exploitEPSS 0%

    symfony · twigSep 9, 2024

  • CVE-2026-24425
    34Monitor

    Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface

    HighCVSS 8.7No exploitEPSS 0%

    symfony · twigMay 20, 2026

  • CVE-2026-46633
    34Monitor

    Twig: PHP code injection via `{% use %}` template name

    HighCVSS 8.7No exploitEPSS 0%

    symfony · twigJul 14, 2026

  • CVE-2026-46640
    34Monitor

    Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation

    HighCVSS 8.7No exploitEPSS 0%

    symfony · twigJul 14, 2026

  • CVE-2022-39261
    31Monitor

    Twig may load a template outside a configured directory when using the filesystem loader

    HighCVSS 7.5No exploitEPSS 3%

    symfony · twigSep 28, 2022

  • CVE-2001-1537
    30Monitor

    The default "basic" security setting' in config.php for TWIG webmail 2.7.4 and earlier stores cleartext usernames and passwords in cookies,

    HighCVSS 7.5No exploitEPSS 1%

    symfony · twigDec 31, 2001

  • CVE-2024-36611
    30Monitor

    In Symfony v7.07, a security vulnerability was identified in the FormLoginAuthenticator component, where it failed to adequately handle case

    HighCVSS 7.5No exploitEPSS 0%

    Nov 29, 2024

  • CVE-2026-46634
    30Monitor

    Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name

    HighCVSS 7.7No exploitEPSS 0%

    symfony · twigJul 14, 2026

  • CVE-2015-7809
    28Monitor

    The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote attackers to execute a

    MediumCVSS 6.8No exploitEPSS 3%

    symfony · twigNov 6, 2015

  • CVE-2026-46627
    28Monitor

    Twig: Sandbox resource exhaustion via unbounded `for` / `range()`

    HighCVSS 7.1No exploitEPSS 0%

    symfony · twigJul 14, 2026

  • CVE-2026-48806
    28Monitor

    Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys

    HighCVSS 7.1No exploitEPSS 0%

    symfony · twigJul 14, 2026

  • CVE-2026-47732
    28Monitor

    Twig Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points

    HighCVSS 7.1No exploitEPSS 0%

    symfony · twigJul 14, 2026

  • CVE-2026-46639
    28Monitor

    Twig: Sandbox property and method bypass via object-destructuring assignment

    HighCVSS 7.1No exploitEPSS 0%

    symfony · twigJul 14, 2026

  • CVE-2026-48807
    28Monitor

    Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters

    HighCVSS 7.1No exploitEPSS 0%

    symfony · twigJul 14, 2026

  • CVE-2026-49211
    27Monitor

    Symfony UX: Information exposure via unescaped LIKE wildcards in EntitySearchUtil

    MediumCVSS 6.9No exploitEPSS 0%

    symfony · uxJul 17, 2026

  • CVE-2026-49208
    27Monitor

    Symfony UX: Format-less date LiveProps parsed with the permissive DateTime constructor

    MediumCVSS 6.9No exploitEPSS 0%

    symfony · uxJul 17, 2026

  • CVE-2026-49212
    27Monitor

    Symfony UX: LiveComponentHydrator HMAC checksum lacks component and slot binding

    MediumCVSS 6.9No exploitEPSS 0%

    symfony · uxJul 17, 2026

  • CVE-2023-41336
    26Monitor

    Prevent injection of invalid entity ids for "autocomplete" fields in symfony ux-autocomplete

    MediumCVSS 6.5No exploitEPSS 0%

    symfony · ux autocompleteSep 11, 2023

  • CVE-2023-46734
    24Monitor

    Symfony potential Cross-site Scripting vulnerabilities in CodeExtension filters

    MediumCVSS 6.1No exploitEPSS 0%

    symfony · twig-bridgeNov 10, 2023

  • CVE-2026-46638
    24Monitor

    Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)

    MediumCVSS 6.0No exploitEPSS 0%

    symfony · twigJul 14, 2026

  • CVE-2026-48808
    24Monitor

    Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`

    MediumCVSS 6.0No exploitEPSS 0%

    symfony · twigJul 14, 2026

  • CVE-2026-49981
    24Monitor

    Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`

    MediumCVSS 6.0No exploitEPSS 0%

    symfony · twigJul 14, 2026

  • CVE-2026-55877
    24Monitor

    Symfony UX: XSS in symfony/ux-icons via unsanitized SVG content in local files and Iconify on-demand responses

    MediumCVSS 6.1No exploitEPSS 0%

    symfony · uxJul 8, 2026