symfony vulnerabilities

Recent CVEs affecting symfony products. 23 tracked.

symfony has 23 tracked vulnerabilities, 5 critical. A fixed release or vendor patch exists for 23. Most recent: 2026-07-17. Highest priority: CVE-2026-46633 (score 52/100).

• CVE-2026-46633 CRITICAL 9.8 UPGRADE Twig is a template language for PHP
• CVE-2026-46634 CRITICAL 9.8 UPGRADE Twig is a template language for PHP
• CVE-2026-48805 CRITICAL 9.1 UPGRADE Twig is a template language for PHP
• CVE-2026-48806 CRITICAL 9.1 UPGRADE Twig is a template language for PHP
• CVE-2026-48807 CRITICAL 9.1 UPGRADE Twig is a template language for PHP
• CVE-2026-46640 HIGH 8.8 UPGRADE Twig is a template language for PHP
• CVE-2026-49981 HIGH 8.2 UPGRADE Twig is a template language for PHP
• CVE-2026-48808 HIGH 7.5 UPGRADE Twig is a template language for PHP
• CVE-2026-46638 HIGH 8.1 UPGRADE Twig is a template language for PHP
• CVE-2026-46627 MEDIUM 6.5 UPGRADE Twig is a template language for PHP
• CVE-2026-46629 MEDIUM 6.5 UPGRADE Twig is a template language for PHP
• CVE-2026-46639 MEDIUM 6.5 UPGRADE Twig is a template language for PHP
• CVE-2026-47732 MEDIUM 6.5 UPGRADE Twig is a template language for PHP
• CVE-2026-46628 MEDIUM 5.4 UPGRADE Twig is a template language for PHP
• CVE-2026-47730 MEDIUM 5.4 UPGRADE Twig is a template language for PHP
• CVE-2026-46635 MEDIUM 4.3 UPGRADE Twig is a template language for PHP
• CVE-2026-49211 HIGH 7.5 UPGRADE Symfony UX is a JavaScript ecosystem for Symfony
• CVE-2026-49212 HIGH 7.5 UPGRADE Symfony UX is a JavaScript ecosystem for Symfony
• CVE-2026-49209 MEDIUM 6.5 UPGRADE Symfony UX is a JavaScript ecosystem for Symfony
• CVE-2026-49208 MEDIUM 5.3 UPGRADE Symfony UX is a JavaScript ecosystem for Symfony
• CVE-2026-49210 MEDIUM 6.1 UPGRADE Symfony UX is a JavaScript ecosystem for Symfony
• CVE-2026-49216 MEDIUM 5.4 UPGRADE Symfony UX is a JavaScript ecosystem for Symfony
• CVE-2026-49215 MEDIUM 5.4 UPGRADE Symfony UX is a JavaScript ecosystem for Symfony

FAQ

How do I fix symfony vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is symfony being exploited right now?

None of the tracked symfony CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which symfony CVE should I patch first?

CVE-2026-46633 currently ranks highest (52/100): Twig is a template language for PHP.

Products

• twig
• ux

← Back to latest CVEs