Composer symfony/http-kernel has 8 known advisories in the phpwarden feed. Feed 2026.10.29.4, updated 2026-10-29.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2015-4050 | Symfony Incorrect Access Control | medium | 0.0 | >=2.3.19 and <2.3.29 or >=2.5.4 and <2.5.12 or >=2.6.0 and <2.6.8 or >=2.4.9 and <=2.4.10 or >=2.4.9 and <2.5.0 | 2.3.29, 2.5.12, 2.6.8, 2.5.0 |
| CVE-2022-24894 | Symfony storing cookie headers in HttpCache | medium | 5.9 | >=2.0.0 and <4.4.50 or >=5.0.0 and <5.4.20 or >=6.0.0 and <6.0.20 or >=6.1.0 and <6.1.12 or >=6.2.0 and <6.2.6 or >=2.0.0 and <2.1.0 or >=2.1.0 and <2.2.0 or >=2.2.0 and <2.3.0 or >=2.3.0 and <2.4.0 or >=2.4.0 and <2.5.0 or >=2.5.0 and <2.6.0 or >=2.6.0 and <2.7.0 or >=2.7.0 and <2.8.0 or >=2.8.0 and <3.0.0 or >=3.0.0 and <3.1.0 or >=3.1.0 and <3.2.0 or >=3.2.0 and <3.3.0 or >=3.3.0 and <3.4.0 or >=3.4.0 and <4.0.0 or >=4.0.0 and <4.1.0 or >=4.1.0 and <4.2.0 or >=4.2.0 and <4.3.0 or >=4.3.0 and <4.4.0 or >=4.4.0 and <4.4.50 or >=5.0.0 and <5.1.0 or >=5.1.0 and <5.2.0 or >=5.2.0 and <5.3.0 or >=5.3.0 and <5.4.0 or >=5.4.0 and <5.4.20 | 4.4.50, 5.4.20, 6.0.20, 6.1.12 |
| CVE-2020-15094 | RCE in Symfony | high | 8.0 | >=4.3.0 and <4.4.13 or >=5.0.0 and <5.1.5 or >=4.3.0 and <4.4.0 or >=4.4.0 and <4.4.13 or >=5.0.0 and <5.1.0 or >=5.1.0 and <5.1.5 | 4.4.13, 5.1.5 |
| CVE-2019-18887 | Symfony Http-Kernel has non-constant time comparison in UriSigner | high | 8.1 | >=2.2.0 and <2.8.52 or >=3.0.0 and <3.4.35 or >=4.0.0 and <4.2.12 or >=4.3.0 and <4.3.8 or >=2.2.0 and <2.3.0 or >=2.3.0 and <2.4.0 or >=2.4.0 and <2.5.0 or >=2.5.0 and <2.6.0 or >=2.6.0 and <2.7.0 or >=2.7.0 and <2.8.0 or >=2.8.0 and <2.8.52 or >=3.0.0 and <3.1.0 or >=3.1.0 and <3.2.0 or >=3.2.0 and <3.3.0 or >=3.3.0 and <3.4.0 or >=3.4.0 and <3.4.35 or >=4.0.0 and <4.1.0 or >=4.1.0 and <4.2.0 or >=4.2.0 and <4.2.12 | 2.8.52, 3.4.35, 4.2.12, 4.3.8 |
| CVE-2015-2308 | Symfony Vulnerable to PHP Eval Injection | medium | 0.0 | >=2.0.0 and <2.3.27 or >=2.4.0 and <2.5.11 or >=2.6.0 and <2.6.6 or >=2.0.0 and <2.1.0 or >=2.1.0 and <2.2.0 or >=2.2.0 and <2.3.0 or >=2.3.0 and <2.3.27 or >=2.4.0 and <2.5.0 or >=2.5.0 and <2.5.11 | 2.3.27, 2.5.11, 2.6.6 |
| CVE-2021-41267 | Webcache Poisoning in symfony/http-kernel | medium | 6.5 | >=5.2.0 and <5.3.12 or >=5.2.0 and <5.3.0 or >=5.3.0 and <5.3.12 | 5.3.12 |
| CVE-2026-45075 | Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid] | high | 0.0 | >=7.4.0 and <7.4.12 or >=8.0.0 and <8.0.12 | 7.4.12, 8.0.12 |
| CVE-2014-5245 | Symfony allows direct access of ESI URLs behind a trusted proxy | high | 7.5 | >=2.0.0 and <2.3.19 or >=2.4.0 and <2.4.9 or >=2.5.0 and <2.5.4 or >=2.0.0 and <2.1.0 or >=2.1.0 and <2.2.0 or >=2.2.0 and <2.3.0 or >=2.3.0 and <2.3.19 | 2.3.19, 2.4.9, 2.5.4 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# PHP projects (recommended) composer require --dev phpwarden/phpwarden # then vendor/bin/phpwarden deps composer.lock # or, without Composer pipx install phpwarden && phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked