p PatchFirst

PatchFirst · Latest vulnerabilities

symfony/cache vulnerabilities

Vulnerabilities published for symfony/cache in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 3

  1. CVE-2026-45073

    Medium · CVSS 6.3EPSS 0.46%Fix available

    Symfony: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, PdoAdapter::doClear() builds a DELETE statement using a namespace derived from the caller-supplied $prefix without binding or escaping it, allowing a caller able to influence $prefix to break out of the LIKE literal and alter query semantics or deletion scope. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

    symfony/cache symfony/cache symfony/cache symfony/cachePHP
    • Update to 5.4.52
    • Update to 6.4.40
    • Update to 7.4.12
    • Update to 8.0.12
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2019-10912

    High · CVSS 7.1EPSS 2.26%Fix available

    CVE-2019-10912

    In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is related to symfony/cache and symfony/phpunit-bridge.

    symfony/cache symfony/cache symfony/cachePHP
    • Update to 3.4.26
    • Update to 4.1.12
    • Update to 4.2.7
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →