packagist.org: symfony/symfony

The Symfony PHP framework

• Homepage: https://symfony.com
• Licenses: MIT
• Latest release: v8.1.4 (published 16 days ago)
• Last Synced: 2026-08-22T16:32:59.313Z (1 day ago)
• Versions: 872
• Dependent Packages: 3,530
• Dependent Repositories: 22,779
• Downloads: 87,614,447 Total
• Docker Downloads: 2,569,914
• Rankings:
  • Forks count: 0.005%
  • Stargazers count: 0.005%
  • Dependent packages count: 0.011%
  • Dependent repos count: 0.058%
  • Downloads: 0.063%
  • Average: 0.068%
  • Docker downloads count: 0.264%
• Maintainers (1)
  • fabpot
• Funding:
  • url: https://symfony.com/sponsor: type: custom
  • url: https://github.com/fabpot: type: github
  • url: https://github.com/nicolas-grekas: type: github
  • url: https://tidelift.com/funding/github/packagist/symfony/symfony: type: tidelift
• Advisories:
  • Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization
  • Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade
  • Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient
  • Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
  • Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes
  • SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch
  • Symfony: Twilio SMS Notifier allows unauthenticated webhook injection due to missing X-Twilio-Signature verification
  • Symfony's JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS
  • Symfony's Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection
  • Symfony's Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection
  • Symfony's HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — `javascript`: URI Survives Sanitization (XSS)
  • Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex
  • Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")
  • Symfony hardened the parser when handling untrusted input
  • Symfony has Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener
  • Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
  • Symfony's Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay
  • Symfony Vulnerable to SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix
  • Symfony Vulnerable to stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering
  • Symfony has XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true
  • Symfony has Email Header Injection via Non-Token Characters in Mime Parameter Names
  • Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims
  • Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address
  • Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
  • Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification
  • Symfony's HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing
  • Symfony has a UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection
  • Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator
  • Symfony's incorrect argument escaping under MSYS2/Git Bash can lead to destructive file operations on Windows
  • Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass
  • Symfony vulnerable to command execution hijack on Windows with Process class
  • Symfony has an incorrect response from Validator when input ends with `\n`
  • Symfony's `Security::login` does not take into account custom `user_checker`
  • Symfony allows changing the environment through a query
  • Symfony Cross-Site Request Forgery vulnerability in the Web Profiler
  • Symfony2 improper IP based access control
  • Symfony XML Entity Expansion security vulnerability
  • Symfony XML decoding attack vector through external entities
  • Symfony may allow a user to switch to using another user's identity
  • Symfony allows direct access of ESI URLs behind a trusted proxy
  • Symfony has unsafe methods in the Request class
  • Symfony has a security issue when parsing the Authorization header
  • Symfony vulnerable to denial of service via a malicious HTTP Host header
  • Symfony2 security issue when the trust proxy mode is enabled
  • Code injection in the way Symfony implements translation caching in FrameworkBundle
  • Symfony potential Cross-site Scripting in WebhookController
  • Symfony potential Cross-site Scripting vulnerabilities in CodeExtension filters
  • Symfony possible session fixation vulnerability
  • Symfony storing cookie headers in HttpCache
  • Symfony vulnerable to Session Fixation of CSRF tokens
  • Symfony Incorrect Access Control
  • Symfony Access Control Vulnerability
  • Symfony Allows URI Restrictions Bypass Via Double-Encoded String
  • Symfony Denial of Service Via Long Password Hashing
  • Symphony Denial of Service Via Overlong Usernames
  • Symfony Cryptographic Vulnerability
  • Symfony Vulnerable to PHP Eval Injection
  • Symfony Vulnerable to Timing Attack
  • Symfony Incorrect Access Control
  • Symphony Vulnerable to PHP Code Injection via YAML Parsing
  • Symfony Arbitrary PHP code Execution
  • Symfony Authentication Bypass
  • Symfony Authentication Bypass
  • Symfony Session Fixation Vulnerability
  • Symfony SSRF Vulnerability via Form Component
  • Symfony Host Header Injection
  • Symfony Session Fixation Vulnerability
  • Symfony Open Redirect
  • Symfony Directory Traversal
  • Symfony Open Redirect
  • Symfony DoS
  • Symfony CSRF Token Fixation
  • Symfony Path Disclosure
  • Symfony Open Redirect
  • Symfony CSRF Vulnerability
  • Symfony Host Header Injection vulnerability in the HttpFoundation component
  • Symfony Http-Kernel has non-constant time comparison in UriSigner
  • Authentication granted to all firewalls instead of just one
  • Prevent user enumeration using Guard or the new Authenticator-based Security
  • RCE in Symfony
  • Exceptions displayed in non-debug configurations in Symfony
  • Improper authentication in Symfony
  • Deserialization of untrusted data in Symfony
  • Improper Input Validation in Symfony
  • Invalid HTTP method overrides allow possible XSS or other attacks in Symfony
  • User enumeration leak using switch user functionality in Symfony
  • Argument injection in a MimeTypeGuesser in Symfony
  • Symfony Unsafe Cache Serialization Could Enable RCE
  • Symfony Service IDs Allow Injection
  • Symfony Cross-site Scripting (XSS) vulnerability

proxy.golang.org: github.com/symfony/symfony

• Homepage:
• Documentation: https://pkg.go.dev/github.com/symfony/symfony#section-documentation
• Licenses: mit
• Latest release: v8.1.5+incompatible (published 1 day ago)
• Last Synced: 2026-08-22T16:37:13.417Z (1 day ago)
• Versions: 886
• Dependent Packages: 0
• Dependent Repositories: 1
• Rankings:
  • Forks count: 0.023%
  • Stargazers count: 0.048%
  • Average: 3.585%
  • Dependent repos count: 4.706%
  • Dependent packages count: 9.561%

proxy.golang.org: github.com/Symfony/symfony

• Homepage:
• Documentation: https://pkg.go.dev/github.com/Symfony/symfony#section-documentation
• Licenses: mit
• Latest release: v8.1.4+incompatible (published 15 days ago)
• Last Synced: 2026-08-22T16:44:30.829Z (1 day ago)
• Versions: 700
• Dependent Packages: 0
• Dependent Repositories: 0
• Rankings:
  • Dependent packages count: 4.524%
  • Average: 4.677%
  • Dependent repos count: 4.829%

proxy.golang.org: github.com/symfony/Symfony

• Homepage:
• Documentation: https://pkg.go.dev/github.com/symfony/Symfony#section-documentation
• Licenses: mit
• Latest release: v8.1.5+incompatible (published 1 day ago)
• Last Synced: 2026-08-22T16:33:56.376Z (1 day ago)
• Versions: 750
• Dependent Packages: 0
• Dependent Repositories: 0
• Rankings:
  • Dependent packages count: 4.568%
  • Average: 4.721%
  • Dependent repos count: 4.875%

proxy.golang.org: github.com/Symfony/Symfony

• Homepage:
• Documentation: https://pkg.go.dev/github.com/Symfony/Symfony#section-documentation
• Licenses: mit
• Latest release: v8.1.4+incompatible (published 15 days ago)
• Last Synced: 2026-08-22T16:34:41.803Z (1 day ago)
• Versions: 700
• Dependent Packages: 0
• Dependent Repositories: 0
• Rankings:
  • Dependent packages count: 4.568%
  • Average: 4.721%
  • Dependent repos count: 4.875%

packagist.org: linhecheng/cmlphp

The Symfony PHP framework

• Homepage: https://symfony.com
• Status: abandoned
• Licenses: MIT
• Latest release: v8.1.4 (published 16 days ago)
• Last Synced: 2026-08-22T16:32:59.225Z (1 day ago)
• Versions: 941
• Dependent Packages: 1
• Dependent Repositories: 1
• Downloads: 683 Total
• Rankings:
  • Forks count: 0.004%
  • Stargazers count: 0.005%
  • Dependent packages count: 9.718%
  • Average: 11.537%
  • Dependent repos count: 21.866%
  • Downloads: 26.091%
• Maintainers (1)
  • tomorrowbetter
• Funding:
  • url: https://symfony.com/sponsor: type: custom
  • url: https://github.com/fabpot: type: github
  • url: https://github.com/nicolas-grekas: type: github
  • url: https://tidelift.com/funding/github/packagist/symfony/symfony: type: tidelift