CRA Readiness Snapshot
What you would have to assess for ENISA reporting tomorrow
From 11 September 2026, an actively exploited vulnerability in software you ship must be reported to ENISA within 24 hours of awareness (CRA Art. 14). In this snapshot, 2 findings are in the CISA KEV catalog (1 in production dependencies):
| Package | Your version | CVE | Fixed in | Exploit context |
|---|---|---|---|---|
| phpunit/phpunit dev | ^12.5.23 (unpinned) | CVE-2017-9841 | 4.8.28 | KEV listed 2022-02-15 |
| laravel/framework | ^12.40.0 || ^13.0 (unpinned) | CVE-2018-15133 | 5.6.30 | KEV listed 2024-01-16 |
⚠ No lockfile — SBOM is not reproducible
This scan is based on a manifest (package-lock.json, composer.json), not a lockfile. 43 of 735 dependencies are version ranges, so the exact shipped versions — and their transitive dependencies — cannot be verified. Under the CRA's full obligations (11 December 2027) you must produce a machine-readable SBOM of what you actually ship. Committing a lockfile is the single highest-impact fix in this report.
All findings (92)
| Package | Version | Advisory | Severity | EPSS | Fixed in | Summary |
|---|---|---|---|---|---|---|
| symfony/http-foundation | ^7.3.7 || ^8.0 | CVE-2018-14773 | MODERATE | 58.1% | 2.7.49 | Symfony HTTP Foundation web cache poisoning |
| guzzlehttp/guzzle | ^6.3 || ^7.0 | CVE-2016-5385 | HIGH | 50.4% | 6.2.1 | HTTP Proxy header vulnerability |
| james-heinrich/getid3 | ^1.9.21 | CVE-2014-2053 | HIGH | 4.7% | 1.9.9 | getID3 is vulnerable to XML External Entity (XXE) |
| symfony/var-exporter | ^7.0.3 || ^8.0 | CVE-2019-11325 | CRITICAL | 3.4% | 4.2.12 | Improper Input Validation in Symfony |
| laravel/framework | ^12.40.0 || ^13.0 | CVE-2020-19316 | HIGH | 2.5% | 5.8.17 | OS Command Injection in Laravel Framework |
| doctrine/dbal dev | ^3.6 | CVE-2021-43608 | CRITICAL | 2.4% | 3.1.4 | DBAL 3 SQL Injection Security Vulnerability |
| symfony/http-foundation | ^7.3.7 || ^8.0 | CVE-2013-4752 | MODERATE | 2.3% | 2.0.24 | Symfony Host Header Injection vulnerability in the HttpFoundation component |
| symfony/http-foundation | ^7.3.7 || ^8.0 | CVE-2019-18888 | HIGH | 2.2% | 2.8.52 | Argument injection in a MimeTypeGuesser in Symfony |
| guzzlehttp/guzzle | ^6.3 || ^7.0 | CVE-2022-31090 | HIGH | 1.9% | 6.5.8 | CURLOPT_HTTPAUTH option not cleared on change of origin |
| guzzlehttp/guzzle | ^6.3 || ^7.0 | CVE-2022-31042 | HIGH | 1.9% | 6.5.7 | Failure to strip the Cookie header on change in host or HTTP downgrade |
| guzzlehttp/guzzle | ^6.3 || ^7.0 | CVE-2022-31042 | HIGH | 1.9% | 6.5.7 | Fix failure to strip Authorization header on HTTP downgrade |
| symfony/http-foundation | ^7.3.7 || ^8.0 | CVE-2012-6431 | MODERATE | 1.9% | 2.0.19 | Symfony Allows URI Restrictions Bypass Via Double-Encoded String |
| symfony/http-foundation | ^7.3.7 || ^8.0 | CVE-2019-10913 | CRITICAL | 1.9% | 2.7.51 | Invalid HTTP method overrides allow possible XSS or other attacks in Symfony |
| symfony/yaml | ^7.0.3 || ^8.0 | CVE-2013-1348 | HIGH | 1.6% | 2.0.22 | Symphony Vulnerable to PHP Code Injection via YAML Parsing |
| symfony/yaml | ^7.0.3 || ^8.0 | CVE-2013-1397 | HIGH | 1.6% | 2.0.22 | Symfony Arbitrary PHP code Execution |
| symfony/http-foundation | ^7.3.7 || ^8.0 | CVE-2018-11386 | MODERATE | 1.6% | 2.7.48 | Symfony DoS |
| laravel/framework | ^12.40.0 || ^13.0 | CVE-2021-21263 | HIGH | 1.6% | 8.22.1 | Query Binding Exploitation |
| league/commonmark | ^2.2 | CVE-2018-20583 | MODERATE | 1.6% | 0.18.1 | PHP League CommonMark vulnerable to Cross-Site Scripting (XSS) |
| guzzlehttp/guzzle | ^6.3 || ^7.0 | CVE-2022-31091 | HIGH | 1.5% | 6.5.8 | Change in port should be considered a change in origin |
| guzzlehttp/guzzle | ^6.3 || ^7.0 | CVE-2022-29248 | HIGH | 1.3% | 6.5.6 | Cross-domain cookie leakage in Guzzle |
| symfony/http-foundation | ^7.3.7 || ^8.0 | CVE-2020-5255 | LOW | 1.3% | 4.4.7 | Prevent cache poisoning via a Response Content-Type header in Symfony |
| laravel/framework | ^12.40.0 || ^13.0 | CVE-2017-14775 | MODERATE | 1.2% | 5.5.10 | Laravel Sensitive Data Exposure |
| laravel/framework | ^12.40.0 || ^13.0 | CVE-2020-24941 | HIGH | 1.1% | 6.18.35 | Improper Input Validation in Laravel |
| league/commonmark | ^2.2 | CVE-2019-10010 | MODERATE | 1.1% | 0.18.3 | Moderate severity vulnerability that affects league/commonmark |
| james-heinrich/getid3 | ^1.9.21 | CVE-2021-40926 | MODERATE | 1.0% | 1.9.21 | Cross-site scripting in demos/demo.mysqli.php in getID3 |
| laravel/framework | ^12.40.0 || ^13.0 | CVE-2017-9303 | MODERATE | 1.0% | 5.4.22 | Laravel does not properly constrain the host portion of a password-reset URL |
| laravel/framework | ^12.40.0 || ^13.0 | CVE-2021-43808 | MODERATE | 0.8% | 6.20.42 | Laravel Framework XSS in Blade templating engine |
| laravel/framework | ^12.40.0 || ^13.0 | CVE-2024-13918 | MODERATE | 0.6% | 11.36.0 | Laravel framework susceptible to reflected cross-site scripting |
| laravel/framework | ^12.40.0 || ^13.0 | CVE-2024-13919 | MODERATE | 0.5% | 11.36.0 | Laravel framework susceptible to reflected cross-site scripting |
| rhukster/dom-sanitizer | ^1.0.10 | CVE-2023-49146 | MODERATE | 0.4% | 1.0.7 | Cross-site Scripting in DOMSanitizer |
+ 62 further findings (mostly lower severity) — available in the full export.
SBOM summary
735 direct dependencies scanned (692 pinned to exact versions) from package-lock.json, composer.json. Vulnerability data: OSV.dev · exploitation status: CISA KEV · exploit probability: FIRST EPSS. Findings on unpinned dependencies cover the full constraint range and may not apply to the exact version deployed.
Using ENISA's CRA Maturity Assessment Model for SMEs? This snapshot provides evidence for the Vulnerability Management domain and the product-level technical documentation question (1.3) under Governance & Documentation.
This snapshot is an automated readiness assessment, not legal advice and not a conformity assessment under the CRA.