CRA Readiness Snapshot
What you would have to assess for ENISA reporting tomorrow
From 11 September 2026, an actively exploited vulnerability in software you ship must be reported to ENISA within 24 hours of awareness (CRA Art. 14). In this snapshot, 1 finding is in the CISA KEV catalog (0 in production dependencies):
| Package | Your version | CVE | Fixed in | Exploit context |
|---|---|---|---|---|
| phpunit/phpunit dev | ^13.0 (unpinned) | CVE-2017-9841 | 4.8.28 | KEV listed 2022-02-15 |
⚠ No lockfile — SBOM is not reproducible
This scan is based on a manifest (composer.json), not a lockfile. 52 of 52 dependencies are version ranges, so the exact shipped versions — and their transitive dependencies — cannot be verified. Under the CRA's full obligations (11 December 2027) you must produce a machine-readable SBOM of what you actually ship. Committing a lockfile is the single highest-impact fix in this report.
All findings (31)
| Package | Version | Advisory | Severity | EPSS | Fixed in | Summary |
|---|---|---|---|---|---|---|
| guzzlehttp/guzzle | ^7.11 | CVE-2016-5385 | HIGH | 50.4% | 6.2.1 | HTTP Proxy header vulnerability |
| doctrine/dbal | ^4.4 | CVE-2021-43608 | CRITICAL | 2.4% | 3.1.4 | DBAL 3 SQL Injection Security Vulnerability |
| guzzlehttp/guzzle | ^7.11 | CVE-2022-31090 | HIGH | 1.9% | 6.5.8 | CURLOPT_HTTPAUTH option not cleared on change of origin |
| guzzlehttp/guzzle | ^7.11 | CVE-2022-31042 | HIGH | 1.9% | 6.5.7 | Failure to strip the Cookie header on change in host or HTTP downgrade |
| guzzlehttp/guzzle | ^7.11 | CVE-2022-31042 | HIGH | 1.9% | 6.5.7 | Fix failure to strip Authorization header on HTTP downgrade |
| guzzlehttp/guzzle | ^7.11 | CVE-2022-31091 | HIGH | 1.5% | 6.5.8 | Change in port should be considered a change in origin |
| cuyz/valinor | ~2.5.0 | CVE-2022-31140 | HIGH | 1.5% | 0.12.0 | Valinor error messages leading to potential data exfiltration before v0.12.0 |
| guzzlehttp/guzzle | ^7.11 | CVE-2022-29248 | HIGH | 1.3% | 6.5.6 | Cross-domain cookie leakage in Guzzle |
| laminas/laminas-diactoros | ^3.8 | CVE-2023-29530 | HIGH | 1.0% | 2.18.1 | HTTP Multiline Header Termination |
| spiral/roadrunner | ^2025.1 | CVE-2025-22871 | CRITICAL | 0.8% | 2025.1.0 | RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency |
| laminas/laminas-diactoros | ^3.8 | CVE-2022-31109 | MODERATE | 0.8% | 2.11.1 | Diactoros before 2.11.1 vulnerable to HTTP Host Header Attack |
| symfony/process | ^8.1 | CVE-2024-51736 | HIGH | 0.4% | 5.4.46 | Symfony vulnerable to command execution hijack on Windows with Process class |
| guzzlehttp/guzzle | ^7.11 | CVE-2026-67353 | MODERATE | 0.4% | 7.15.1 | Guzzle: Unbounded response cookies risk denial of service |
| phpunit/phpunit dev | ^13.0 | CVE-2026-24765 | HIGH | 0.4% | 8.5.52 | PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling |
| doctrine/orm | ^3.7 | CVE-2015-5723 | HIGH | 0.4% | 2.5.1 | Doctrine Security Misconfiguration Vulnerability |
| guzzlehttp/guzzle | ^7.11 | CVE-2026-67339 | MODERATE | 0.4% | 7.14.2 | Guzzle: Proxy-Authorization headers can be sent to origin servers |
| guzzlehttp/guzzle | ^7.11 | CVE-2026-67354 | MODERATE | 0.4% | 7.15.1 | Guzzle: URI fragments disclosed in redirect Referer headers |
| guzzlehttp/guzzle | ^7.11 | CVE-2026-69246 | HIGH | 0.4% | 7.15.2 | Guzzle: Noncanonical host can bypass host-based checks |
| guzzlehttp/guzzle | ^7.11 | CVE-2026-67355 | MODERATE | 0.4% | 7.15.1 | Guzzle: Host-only cookie scope is not preserved |
| phpunit/phpunit dev | ^13.0 | CVE-2026-41570 | HIGH | 0.3% | 12.5.22 | PHPUnit has Argument injection via newline in PHP INI values that are forwarded to child processes |
| symfony/process | ^8.1 | CVE-2026-24739 | MODERATE | 0.2% | 5.4.51 | Symfony's incorrect argument escaping under MSYS2/Git Bash can lead to destructive file operations on Windows |
| guzzlehttp/guzzle | ^7.11 | CVE-2026-55767 | MODERATE | 0.2% | 7.12.1 | guzzlehttp/guzzle: Dot-Only Cookie Domains Match All Hosts |
| guzzlehttp/guzzle | ^7.11 | CVE-2026-69245 | MODERATE | 0.2% | 7.15.2 | Guzzle: Noncanonical cookie domain keeps subdomain scope |
| guzzlehttp/guzzle | ^7.11 | CVE-2026-59883 | MODERATE | 0.2% | 7.12.3 | Guzzle: Cookie Disclosure and Injection via IP-Address Domains |
| guzzlehttp/guzzle | ^7.11 | CVE-2026-55568 | MODERATE | 0.1% | 7.12.1 | guzzlehttp/guzzle: Silent HTTPS-Proxy Downgrade to Cleartext |
| doctrine/orm | ^3.7 | GHSA-6q9v-4hq6-5m67 | CRITICAL | — | 2.0.3 | Doctrine SQL injection vulnerability |
| cuyz/valinor | ~2.5.0 | GHSA-xhr8-mpwq-2rr2 | HIGH | — | 0.7.0 | Automatic named constructor discovery in Valinor |
| doctrine/dbal | ^4.4 | GHSA-76w8-mqx4-wjrf | HIGH | — | 2.0.8 | Doctrine DBAL SQL injection possibility |
| doctrine/orm | ^3.7 | GHSA-vjrg-wpm8-rhrw | HIGH | — | 2.8.4 | doctrine/orm Regression in Query Parenthesis can have Security Implications |
| phpunit/phpunit dev | ^13.0 | GHSA-mh6w-vxff-9wqp | HIGH | — | 12.5.22 | PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes |
+ 1 further findings (mostly lower severity) — available in the full export.
SBOM summary
52 direct dependencies scanned (0 pinned to exact versions) from composer.json. Vulnerability data: OSV.dev · exploitation status: CISA KEV · exploit probability: FIRST EPSS. Findings on unpinned dependencies cover the full constraint range and may not apply to the exact version deployed.
Using ENISA's CRA Maturity Assessment Model for SMEs? This snapshot provides evidence for the Vulnerability Management domain and the product-level technical documentation question (1.3) under Governance & Documentation.
This snapshot is an automated readiness assessment, not legal advice and not a conformity assessment under the CRA.