CRA Readiness Snapshot
0 days
until the EU Cyber Resilience Act 24-hour reporting obligation applies (11 September 2026), including for products already on the market.
120
dependencies in scope
44
known vulnerabilities
0
actively exploited (CISA KEV)
1.3%
highest exploit probability (EPSS)
What you would have to assess for ENISA reporting tomorrow
No dependency in this snapshot currently appears in CISA's Known Exploited Vulnerabilities catalog. Today, nothing would trigger the 24-hour early-warning obligation of CRA Art. 14. That can change any day a new KEV entry lands, which is exactly what continuous monitoring is for.
All findings (44)
| Package | Version | Advisory | Severity | EPSS | Fixed in | Summary |
|---|---|---|---|---|---|---|
| symfony/http-foundation | 7.2.3 | CVE-2025-64500 | HIGH | 1.3% | 5.4.50 | Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass |
| symfony/yaml dev | 7.2.3 | CVE-2026-45304 | LOW | 0.7% | 5.4.52 | Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs") |
| symfony/yaml dev | 7.2.3 | CVE-2026-45305 | LOW | 0.7% | 5.4.52 | Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex |
| league/commonmark | 2.6.1 | CVE-2026-71488 | HIGH | 0.6% | 2.9.0 | league/commonmark: Quadratic-time denial of service when parsing crafted Markdown |
| symfony/yaml dev | 7.2.3 | CVE-2026-45133 | LOW | 0.6% | 5.4.52 | Symfony hardened the parser when handling untrusted input |
| symfony/mime | 7.2.4 | CVE-2026-45067 | HIGH | 0.6% | 5.4.52 | Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address |
| symfony/http-foundation | 7.2.3 | CVE-2026-48736 | MODERATE | 0.6% | 6.4.41 | Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpCli... |
| symfony/polyfill-intl-idn | 1.31.0 | CVE-2026-46644 | LOW | 0.5% | 1.38.1 | symfony/polyfill-intl-idn: xn-- labels with ASCII-only Punycode payloads are treated as equivalent to their decoded form |
| symfony/mailer | 7.2.3 | CVE-2026-45068 | MODERATE | 0.5% | 5.4.52 | Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address |
| league/commonmark | 2.6.1 | CVE-2026-86429 | HIGH | 0.5% | 2.9.1 | league/commonmark: Denial of service in the SmartPunct and Attributes extensions |
| laravel/framework | 12.3.0 | CVE-2026-48019 | HIGH | 0.5% | 13.10.0 | Laravel Framework: CRLF injection in default email rule |
| league/commonmark | 2.6.1 | CVE-2026-86428 | HIGH | 0.5% | 2.10.0 | league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension |
| league/commonmark | 2.6.1 | CVE-2026-86430 | HIGH | 0.5% | 2.9.1 | league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters |
| guzzlehttp/guzzle | 7.9.2 | CVE-2026-67353 | MODERATE | 0.4% | 7.15.1 | Guzzle: Unbounded response cookies risk denial of service |
| phpunit/phpunit dev | 11.5.13 | CVE-2026-24765 | HIGH | 0.4% | 8.5.52 | PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling |
| symfony/mime | 7.2.4 | CVE-2026-45070 | MODERATE | 0.4% | 5.4.52 | Symfony has Email Header Injection via Non-Token Characters in Mime Parameter Names |
| league/commonmark | 2.6.1 | CVE-2025-46734 | MODERATE | 0.4% | 2.7.0 | league/commonmark contains a XSS vulnerability in Attributes extension |
| guzzlehttp/guzzle | 7.9.2 | CVE-2026-67339 | MODERATE | 0.4% | 7.14.2 | Guzzle: Proxy-Authorization headers can be sent to origin servers |
| guzzlehttp/guzzle | 7.9.2 | CVE-2026-67354 | MODERATE | 0.4% | 7.15.1 | Guzzle: URI fragments disclosed in redirect Referer headers |
| guzzlehttp/guzzle | 7.9.2 | CVE-2026-69246 | HIGH | 0.4% | 7.15.2 | Guzzle: Noncanonical host can bypass host-based checks |
| guzzlehttp/guzzle | 7.9.2 | CVE-2026-67355 | MODERATE | 0.4% | 7.15.1 | Guzzle: Host-only cookie scope is not preserved |
| league/commonmark | 2.6.1 | CVE-2026-71478 | MODERATE | 0.4% | 2.9.0 | league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes |
| symfony/routing | 7.2.3 | CVE-2026-45065 | MODERATE | 0.3% | 5.4.52 | Symfony has a UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection |
| symfony/routing | 7.2.3 | CVE-2026-48784 | MODERATE | 0.3% | 5.4.53 | Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normal... |
| league/flysystem | 3.29.1 | CVE-2026-102601 | LOW | 0.3% | 3.35.3 | Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting... |
| psy/psysh dev | 0.12.8 | CVE-2026-25129 | MODERATE | 0.3% | 0.12.19 | PsySH has Local Privilege Escalation via CWD .psysh.php auto-load |
| guzzlehttp/psr7 | 2.7.0 | CVE-2026-59882 | MODERATE | 0.3% | 2.12.3 | guzzlehttp/psr7: Host Confusion via Weak URI Host Validation |
| league/commonmark | 2.6.1 | CVE-2026-33347 | MODERATE | 0.3% | 2.8.2 | league/commonmark has an embed extension allowed_domains bypass |
| guzzlehttp/psr7 | 2.7.0 | CVE-2026-48998 | MODERATE | 0.3% | 2.10.2 | guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation |
| guzzlehttp/psr7 | 2.7.0 | CVE-2026-49214 | MODERATE | 0.3% | 2.10.2 | guzzlehttp/psr7 has CRLF Injection via URI Host Component |
+ 14 further findings (mostly lower severity) — available in the full export.
SBOM summary
120 direct dependencies scanned (120 pinned to exact versions) from composer.lock. Vulnerability data: OSV.dev · exploitation status: CISA KEV · exploit probability: FIRST EPSS. Findings on unpinned dependencies cover the full constraint range and may not apply to the exact version deployed.
Using ENISA's CRA Maturity Assessment Model for SMEs? This snapshot provides evidence for the Vulnerability Management domain and the product-level technical documentation question (1.3) under Governance & Documentation.
This snapshot is an automated readiness assessment, not legal advice and not a conformity assessment under the CRA.
Download SBOM (CycloneDX)
Want this to watch your product continuously and draft the ENISA report the day something turns exploited?
Start monitoring for €99/mo
Talk to us