# Sensiolabs Symfony


- [CVE-2019-11325](https://insights.sbomify.com/CVE-2019-11325/): Improper Input Validation in Symfony (critical 9.8)
- [CVE-2019-18889](https://insights.sbomify.com/CVE-2019-18889/): Symfony Unsafe Cache Serialization Could Enable RCE (critical 9.8)
- [CVE-2017-11365](https://insights.sbomify.com/CVE-2017-11365/): Symfony Incorrect Access Control (critical 9.8)
- [CVE-2019-10910](https://insights.sbomify.com/CVE-2019-10910/): Symfony Service IDs Allow Injection (critical 9.8)
- [CVE-2019-10913](https://insights.sbomify.com/CVE-2019-10913/): Invalid HTTP method overrides allow possible XSS or other attacks in Symfony (critical 9.8)
- [CVE-2018-11407](https://insights.sbomify.com/CVE-2018-11407/): Symfony Authentication Bypass (critical 9.8)
- [CVE-2016-2403](https://insights.sbomify.com/CVE-2016-2403/): Symfony Authentication Bypass (critical 9.8)
- [CVE-2026-45063](https://insights.sbomify.com/CVE-2026-45063/): Symfony: Identity Spoofing via Unanchored DN Regex in X509Authenticator (critical 9.1)
- [CVE-2026-45069](https://insights.sbomify.com/CVE-2026-45069/): Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims (high 8.8)
- [CVE-2018-11406](https://insights.sbomify.com/CVE-2018-11406/): Symfony CSRF Token Fixation (high 8.8)
- [CVE-2026-45068](https://insights.sbomify.com/CVE-2026-45068/): Symfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address (high 8.7)
- [CVE-2026-45071](https://insights.sbomify.com/CVE-2026-45071/): Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true (high 8.7)

---
From sbomify Insights: https://insights.sbomify.com/products/sensiolabs/symfony/