Packagist symfony/http-kernel

Name: Packagist symfony/http-kernel
Brand: Packagist

productUS

pkg:composer/symfony/http-kernel

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

unpatched

critical

by severity

0critical4high3medium0low

updated 2026-10-27

vulnerabilities (8)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2022-24894US	high8.8	4.00% (90th)	Exploit	6.1.12	2023-02-03	5 versions
CVE-2015-4050US	medium4.3	8.21% (95th)	—	2.6.8	2015-06-02	4 versions
CVE-2020-15094US	high8.8	3.04% (87th)	—	4.4.13	2020-09-02	2 versions
CVE-2019-18887US	high8.1	1.34% (71st)	—	2.8.52	2019-11-21	4 versions
CVE-2015-2308US	medium6.8	1.34% (71st)	—	2.6.6	2015-06-24	3 versions
CVE-2021-41267US	medium4.3	1.28% (70th)	—	5.3.12	2021-11-24	5.2.0 → 5.3.12
CVE-2026-45075US	high8.2OT elevated	0.43% (37th)	—	8.0.12	2026-07-14	2 versions
CVE-2014-5245US	—	—	—	2.4.9	2014-09-03	3 versions

The flaw types (CWEs) most of these CVEs share.

CWE-200Exposure of Sensitive Information to an Unauthorized Actor1 CVEs
CWE-203Observable Discrepancy1 CVEs
CWE-212Improper Removal of Sensitive Information Before Storage or Transfer1 CVEs
CWE-284Improper Access Control1 CVEs
CWE-285Improper Authorization1 CVEs
CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')1 CVEs
CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')1 CVEs
CWE-863Incorrect Authorization1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.