Vulnerabilidades en symfony
65 resultadosAnálisis Vexday
O Symfony apresenta um volume significativo de 65 CVEs catalogadas, com 39 publicadas nos últimos 90 dias, indicando vulnerabilidades recentes e contínuas. A fraqueza dominante é XSS (CWE-79), típica de frameworks web, embora apenas 1 seja crítica e nenhuma esteja sob ataque ativo no momento. O risco atual é moderado, mas demanda atenção ao padrão de descobertas recentes para detecção de novos exploits.
CVE-2023-41336MEDIUMPrevent injection of invalid entity ids for "autocomplete" fields in symfony ux-autocompleteEPSS 0.6%CVE-2026-45133HIGHSymfony: [Yaml] Harden the parser when handling untrusted inputEPSS 0.6%CVE-2026-45756HIGHSymfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoSEPSS 0.6%CVE-2024-51996HIGHSymphony has an Authentication Bypass via RememberMeEPSS 0.6%CVE-2026-45067MEDIUMSymfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\AddressEPSS 0.6%CVE-2026-48489HIGHSymfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET RoutesEPSS 0.6%CVE-2026-45071HIGHSymfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = trueEPSS 0.6%CVE-2026-48736MEDIUMSymfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClientEPSS 0.6%CVE-2023-46735MEDIUMSymfony potential Cross-site Scripting in WebhookControllerEPSS 0.6%CVE-2022-23601HIGHCSRF token missing in SymfonyEPSS 0.6%CVE-2026-49209MEDIUMSymfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requestsEPSS 0.6%CVE-2024-50345LOWOpen redirect via browser-sanitized URLs in symfony/http-foundationEPSS 0.6%CVE-2026-46644MEDIUMsymfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalenceEPSS 0.5%CVE-2026-49211MEDIUMSymfony UX: Information exposure via unescaped LIKE wildcards in EntitySearchUtilEPSS 0.5%CVE-2026-45068HIGHSymfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient AddressEPSS 0.5%CVE-2026-45074HIGHSymfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket ReplayEPSS 0.5%CVE-2024-50342LOWInternal address and port enumeration allowed by NoPrivateNetworkHttpClient in symfony/http-clientEPSS 0.5%CVE-2026-45073MEDIUMSymfony: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefixEPSS 0.5%CVE-2024-50343LOWIncorrect response from Validator when input ends with `\n` in symfony/validatorEPSS 0.5%CVE-2026-45754MEDIUMSymfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event InjectionEPSS 0.4%