Search for packages
| purl | pkg:composer/symfony/security-http@8.0.12 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
| This package is not known to be affected by vulnerabilities. | ||
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-31pu-2pt7-2fh2 | Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator |
CVE-2026-45063
GHSA-ph86-p8f6-f9r2 |
| VCID-3rs1-f6qt-vqbn | Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims |
CVE-2026-45069
GHSA-29fc-p6c4-24cg |
| VCID-5uge-2gtu-tkdw | Symfony's Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay |
CVE-2026-45074
GHSA-j8gj-9rm5-4xhx |
| VCID-x5hp-7y5c-4qep | Synfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid] |
CVE-2026-45075
GHSA-6439-2f28-8p8q |