CRA Readiness Snapshot
What you would have to assess for ENISA reporting tomorrow
No dependency in this snapshot currently appears in CISA's Known Exploited Vulnerabilities catalog. Today, nothing would trigger the 24-hour early-warning obligation of CRA Art. 14. That can change any day a new KEV entry lands, which is exactly what continuous monitoring is for.
⚠ No lockfile — SBOM is not reproducible
This scan is based on a manifest (composer.json), not a lockfile. 6 of 6 dependencies are version ranges, so the exact shipped versions — and their transitive dependencies — cannot be verified. Under the CRA's full obligations (11 December 2027) you must produce a machine-readable SBOM of what you actually ship. Committing a lockfile is the single highest-impact fix in this report.
All findings (34)
| Package | Version | Advisory | Severity | EPSS | Fixed in | Summary |
|---|---|---|---|---|---|---|
| symfony/http-kernel dev | ^7.4|^8.0 | CVE-2015-4050 | MODERATE | 8.3% | 2.3.29 | Symfony Incorrect Access Control |
| twig/twig dev | ^3.12|^4.0 | CVE-2022-23614 | HIGH | 8.2% | 2.14.11 | Code injection in Twig |
| symfony/http-kernel dev | ^7.4|^8.0 | CVE-2022-24894 | MODERATE | 4.0% | 4.4.50 | Symfony storing cookie headers in HttpCache |
| twig/twig dev | ^3.12|^4.0 | CVE-2015-7809 | HIGH | 3.4% | 1.20.0 | Twig remote code execution in templates |
| symfony/http-kernel dev | ^7.4|^8.0 | CVE-2020-15094 | HIGH | 3.0% | 4.4.13 | RCE in Symfony |
| twig/twig dev | ^3.12|^4.0 | CVE-2022-39261 | HIGH | 2.6% | 1.44.7 | Twig may load a template outside a configured directory when using the filesystem loader |
| twig/twig dev | ^3.12|^4.0 | CVE-2019-9942 | LOW | 1.4% | 1.38.0 | Twig Sandbox Information Disclosure |
| symfony/http-kernel dev | ^7.4|^8.0 | CVE-2015-2308 | MODERATE | 1.4% | 2.3.27 | Symfony Vulnerable to PHP Eval Injection |
| symfony/http-kernel dev | ^7.4|^8.0 | CVE-2019-18887 | HIGH | 1.3% | 2.8.52 | Symfony Http-Kernel has non-constant time comparison in UriSigner |
| symfony/http-kernel dev | ^7.4|^8.0 | CVE-2021-41267 | MODERATE | 1.2% | 5.3.12 | Webcache Poisoning in symfony/http-kernel |
| twig/twig dev | ^3.12|^4.0 | CVE-2024-45411 | MODERATE | 0.8% | 1.44.8 | Twig has a possible sandbox bypass |
| twig/twig dev | ^3.12|^4.0 | CVE-2026-24425 | HIGH | 0.8% | 3.26.0 | Twig: Possible sandbox bypass when using a source policy |
| twig/twig dev | ^3.12|^4.0 | CVE-2026-46633 | CRITICAL | 0.7% | 3.26.0 | Twig: PHP code injection via `{% use %}` template name |
| twig/twig dev | ^3.12|^4.0 | CVE-2026-46640 | HIGH | 0.6% | 3.26.0 | Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation |
| twig/twig dev | ^3.12|^4.0 | CVE-2026-46634 | MODERATE | 0.6% | 3.26.0 | Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name |
| twig/twig dev | ^3.12|^4.0 | CVE-2026-48805 | LOW | 0.5% | 3.27.0 | Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php` |
| twig/twig dev | ^3.12|^4.0 | CVE-2026-46638 | MODERATE | 0.5% | 3.26.0 | Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411) |
| twig/twig dev | ^3.12|^4.0 | CVE-2024-51754 | LOW | 0.4% | 3.11.2 | Twig has unguarded calls to `__toString()` when nesting an object into an array |
| symfony/http-kernel dev | ^7.4|^8.0 | CVE-2026-45075 | HIGH | 0.4% | 7.4.12 | Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid] |
| twig/twig dev | ^3.12|^4.0 | CVE-2024-51755 | LOW | 0.4% | 3.11.2 | Twig has unguarded calls to `__isset()` and to array-accesses when the sandbox is enabled |
| symfony/process dev | ^7.4|^8.0 | CVE-2024-51736 | HIGH | 0.4% | 5.4.46 | Symfony vulnerable to command execution hijack on Windows with Process class |
| twig/twig dev | ^3.12|^4.0 | CVE-2026-48806 | MODERATE | 0.4% | 3.27.0 | Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys |
| twig/twig dev | ^3.12|^4.0 | CVE-2026-48808 | MODERATE | 0.4% | 3.27.0 | Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface` |
| twig/twig dev | ^3.12|^4.0 | CVE-2026-47732 | HIGH | 0.4% | 3.26.0 | Twig: Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points |
| twig/twig dev | ^3.12|^4.0 | CVE-2026-46639 | HIGH | 0.4% | 3.26.0 | Twig: Sandbox property and method bypass via object-destructuring assignment |
| twig/twig dev | ^3.12|^4.0 | CVE-2026-48807 | MODERATE | 0.4% | 3.27.0 | Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters |
| twig/twig dev | ^3.12|^4.0 | CVE-2026-49981 | HIGH | 0.4% | 3.27.0 | Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template` |
| twig/twig dev | ^3.12|^4.0 | CVE-2026-46635 | LOW | 0.3% | 3.26.0 | Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects) |
| twig/twig dev | ^3.12|^4.0 | CVE-2026-47730 | LOW | 0.3% | 3.26.0 | Twig: XSS in profiler HtmlDumper via unescaped template and profile names |
| twig/twig dev | ^3.12|^4.0 | CVE-2026-46628 | LOW | 0.3% | 3.26.0 | Twig: The `spaceless` filter implicitly marks its output as safe |
+ 4 further findings (mostly lower severity) — available in the full export.
SBOM summary
6 direct dependencies scanned (0 pinned to exact versions) from composer.json. Vulnerability data: OSV.dev · exploitation status: CISA KEV · exploit probability: FIRST EPSS. Findings on unpinned dependencies cover the full constraint range and may not apply to the exact version deployed.
Using ENISA's CRA Maturity Assessment Model for SMEs? This snapshot provides evidence for the Vulnerability Management domain and the product-level technical documentation question (1.3) under Governance & Documentation.
This snapshot is an automated readiness assessment, not legal advice and not a conformity assessment under the CRA.