CRA Readiness Snapshot
What you would have to assess for ENISA reporting tomorrow
From 11 September 2026, an actively exploited vulnerability in software you ship must be reported to ENISA within 24 hours of awareness (CRA Art. 14). In this snapshot, 1 finding is in the CISA KEV catalog (0 in production dependencies):
| Package | Your version | CVE | Fixed in | Exploit context |
|---|---|---|---|---|
| phpunit/phpunit dev | ^10.5.1 (unpinned) | CVE-2017-9841 | 4.8.28 | KEV listed 2022-02-15 |
⚠ No lockfile — SBOM is not reproducible
This scan is based on a manifest (composer.json), not a lockfile. 35 of 35 dependencies are version ranges, so the exact shipped versions — and their transitive dependencies — cannot be verified. Under the CRA's full obligations (11 December 2027) you must produce a machine-readable SBOM of what you actually ship. Committing a lockfile is the single highest-impact fix in this report.
All findings (50)
| Package | Version | Advisory | Severity | EPSS | Fixed in | Summary |
|---|---|---|---|---|---|---|
| laminas/laminas-http dev | ^2.13 | CVE-2021-3007 | CRITICAL | 75.3% | 2.14.2 | Remote code execution in zendframework and laminas-http |
| guzzlehttp/guzzle dev | ^7.5 | CVE-2016-5385 | HIGH | 50.4% | 6.2.1 | HTTP Proxy header vulnerability |
| symfony/http-kernel dev | ^7.0 | CVE-2015-4050 | MODERATE | 8.2% | 2.3.29 | Symfony Incorrect Access Control |
| symfony/http-kernel dev | ^7.0 | CVE-2022-24894 | MODERATE | 4.0% | 4.4.50 | Symfony storing cookie headers in HttpCache |
| symfony/http-kernel dev | ^7.0 | CVE-2020-15094 | HIGH | 3.0% | 4.4.13 | RCE in Symfony |
| guzzlehttp/psr7 dev | ^1.7|^2.0 | CVE-2022-24775 | MODERATE | 2.5% | 1.8.4 | Improper Input Validation in guzzlehttp/psr7 |
| guzzlehttp/guzzle dev | ^7.5 | CVE-2022-31090 | HIGH | 1.9% | 6.5.8 | CURLOPT_HTTPAUTH option not cleared on change of origin |
| guzzlehttp/guzzle dev | ^7.5 | CVE-2022-31042 | HIGH | 1.9% | 6.5.7 | Failure to strip the Cookie header on change in host or HTTP downgrade |
| guzzlehttp/guzzle dev | ^7.5 | CVE-2022-31042 | HIGH | 1.9% | 6.5.7 | Fix failure to strip Authorization header on HTTP downgrade |
| symfony/yaml dev | ^7.0 | CVE-2013-1348 | HIGH | 1.6% | 2.0.22 | Symphony Vulnerable to PHP Code Injection via YAML Parsing |
| symfony/yaml dev | ^7.0 | CVE-2013-1397 | HIGH | 1.6% | 2.0.22 | Symfony Arbitrary PHP code Execution |
| illuminate/database dev | ^11.5 | CVE-2021-21263 | HIGH | 1.6% | 7.30.3 | Query Binding Exploitation |
| guzzlehttp/guzzle dev | ^7.5 | CVE-2022-31091 | HIGH | 1.5% | 6.5.8 | Change in port should be considered a change in origin |
| symfony/http-kernel dev | ^7.0 | CVE-2015-2308 | MODERATE | 1.4% | 2.3.27 | Symfony Vulnerable to PHP Eval Injection |
| guzzlehttp/guzzle dev | ^7.5 | CVE-2022-29248 | HIGH | 1.3% | 6.5.6 | Cross-domain cookie leakage in Guzzle |
| symfony/http-kernel dev | ^7.0 | CVE-2019-18887 | HIGH | 1.3% | 2.8.52 | Symfony Http-Kernel has non-constant time comparison in UriSigner |
| symfony/http-kernel dev | ^7.0 | CVE-2021-41267 | MODERATE | 1.3% | 5.3.12 | Webcache Poisoning in symfony/http-kernel |
| guzzlehttp/psr7 dev | ^1.7|^2.0 | CVE-2023-29197 | MODERATE | 1.2% | 1.9.1 | Improper header name validation in guzzlehttp/psr7 |
| illuminate/database dev | ^11.5 | CVE-2020-24940 | HIGH | 1.2% | 6.18.34 | Guard bypass in Eloquent models affecting Laravel illuminate database component |
| react/http dev | dev-websocket-support | CVE-2022-36032 | MODERATE | 1.0% | 1.7.0 | ReactPHP's HTTP server parses encoded cookie names so malicious `__Host-` and `__Secure-` cookies can be sent |
| illuminate/view dev | ^11.5 | CVE-2021-43808 | MODERATE | 0.8% | 6.20.42 | Laravel Framework XSS in Blade templating engine |
| symfony/yaml dev | ^7.0 | CVE-2026-45304 | LOW | 0.7% | 5.4.52 | Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs") |
| symfony/yaml dev | ^7.0 | CVE-2026-45305 | LOW | 0.7% | 5.4.52 | Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex |
| react/http dev | dev-websocket-support | CVE-2023-26044 | MODERATE | 0.7% | 1.9.0 | ReactPHP's HTTP server continues parsing unused multipart parts after reaching input field and file upload limits |
| react/http dev | dev-websocket-support | CVE-2026-84997 | HIGH | 0.7% | 1.11.1 | react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU |
| symfony/yaml dev | ^7.0 | CVE-2026-45133 | LOW | 0.6% | 5.4.52 | Symfony hardened the parser when handling untrusted input |
| symfony/http-kernel dev | ^7.0 | CVE-2026-45075 | HIGH | 0.4% | 7.4.12 | Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid] |
| guzzlehttp/guzzle dev | ^7.5 | CVE-2026-67353 | MODERATE | 0.4% | 7.15.1 | Guzzle: Unbounded response cookies risk denial of service |
| phpunit/phpunit dev | ^10.5.1 | CVE-2026-24765 | HIGH | 0.4% | 8.5.52 | PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling |
| guzzlehttp/guzzle dev | ^7.5 | CVE-2026-67339 | MODERATE | 0.4% | 7.14.2 | Guzzle: Proxy-Authorization headers can be sent to origin servers |
+ 20 further findings (mostly lower severity) — available in the full export.
SBOM summary
35 direct dependencies scanned (0 pinned to exact versions) from composer.json. Vulnerability data: OSV.dev · exploitation status: CISA KEV · exploit probability: FIRST EPSS. Findings on unpinned dependencies cover the full constraint range and may not apply to the exact version deployed.
Using ENISA's CRA Maturity Assessment Model for SMEs? This snapshot provides evidence for the Vulnerability Management domain and the product-level technical documentation question (1.3) under Governance & Documentation.
This snapshot is an automated readiness assessment, not legal advice and not a conformity assessment under the CRA.