Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address

Argument injection in a MimeTypeGuesser in Symfony

Invalid HTTP method overrides allow possible XSS or other attacks in Symfony

Symfony has XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true

Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes

Symfony Path Disclosure

Symfony Authentication Bypass

Symphony Denial of Service Via Overlong Usernames

Improper Input Validation in Symfony

Deserialization of untrusted data in Symfony

CSRF token missing in Symfony

Symfony has Email Header Injection via Non-Token Characters in Mime Parameter Names

Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense

Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade

Authentication granted to all firewalls instead of just one

Symfony Open Redirect

Symfony's incorrect argument escaping under MSYS2/Git Bash can lead to destructive file operations on Windows

Symfony DoS

Cookie persistence after password changes in symfony/security-bundle

Symfony vulnerable to command execution hijack on Windows with Process class