CRA Readiness Snapshot
What you would have to assess for ENISA reporting tomorrow
From 11 September 2026, an actively exploited vulnerability in software you ship must be reported to ENISA within 24 hours of awareness (CRA Art. 14). In this snapshot, 1 finding is in the CISA KEV catalog (0 in production dependencies):
| Package | Your version | CVE | Fixed in | Exploit context |
|---|---|---|---|---|
| phpunit/phpunit dev | ^6.0 || ^7.0 || ^8.0 || ^9.0 || ^10.0 || ^11.5.3 (unpinned) | CVE-2017-9841 | 4.8.28 | KEV listed 2022-02-15 |
⚠ No lockfile — SBOM is not reproducible
This scan is based on a manifest (composer.json), not a lockfile. 14 of 14 dependencies are version ranges, so the exact shipped versions — and their transitive dependencies — cannot be verified. Under the CRA's full obligations (11 December 2027) you must produce a machine-readable SBOM of what you actually ship. Committing a lockfile is the single highest-impact fix in this report.
All findings (26)
| Package | Version | Advisory | Severity | EPSS | Fixed in | Summary |
|---|---|---|---|---|---|---|
| codeigniter/framework dev | ~3.0 | CVE-2014-8684 | CRITICAL | 71.7% | 3.0.0 | CodeIgniter and Kohana vulnerable to PHP Object Injection |
| symfony/http-foundation | ^2.8 || ^3.0 || ^4.0 || ^5.0 || ^6.0 || ^7.0 | CVE-2018-14773 | MODERATE | 57.6% | 2.7.49 | Symfony HTTP Foundation web cache poisoning |
| symfony/cache dev | ^3.4.35 || ^4.3.7 || ^5.0 || ^7.2 | CVE-2019-18889 | CRITICAL | 33.2% | 3.4.35 | Symfony Unsafe Cache Serialization Could Enable RCE |
| symfony/http-foundation | ^2.8 || ^3.0 || ^4.0 || ^5.0 || ^6.0 || ^7.0 | CVE-2013-4752 | MODERATE | 2.3% | 2.0.24 | Symfony Host Header Injection vulnerability in the HttpFoundation component |
| symfony/cache dev | ^3.4.35 || ^4.3.7 || ^5.0 || ^7.2 | CVE-2019-10912 | HIGH | 2.3% | 3.4.26 | Deserialization of untrusted data in Symfony |
| symfony/http-foundation | ^2.8 || ^3.0 || ^4.0 || ^5.0 || ^6.0 || ^7.0 | CVE-2019-18888 | HIGH | 2.2% | 2.8.52 | Argument injection in a MimeTypeGuesser in Symfony |
| symfony/http-foundation | ^2.8 || ^3.0 || ^4.0 || ^5.0 || ^6.0 || ^7.0 | CVE-2012-6431 | MODERATE | 1.9% | 2.0.19 | Symfony Allows URI Restrictions Bypass Via Double-Encoded String |
| symfony/http-foundation | ^2.8 || ^3.0 || ^4.0 || ^5.0 || ^6.0 || ^7.0 | CVE-2019-10913 | CRITICAL | 1.9% | 2.7.51 | Invalid HTTP method overrides allow possible XSS or other attacks in Symfony |
| symfony/http-foundation | ^2.8 || ^3.0 || ^4.0 || ^5.0 || ^6.0 || ^7.0 | CVE-2018-11386 | MODERATE | 1.6% | 2.7.48 | Symfony DoS |
| codeigniter/framework dev | ~3.0 | CVE-2018-12071 | CRITICAL | 1.5% | 3.1.10 | CodeIgniter Session Fixation Vulnerability |
| symfony/http-foundation | ^2.8 || ^3.0 || ^4.0 || ^5.0 || ^6.0 || ^7.0 | CVE-2025-64500 | HIGH | 1.4% | 5.4.50 | Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass |
| symfony/http-foundation | ^2.8 || ^3.0 || ^4.0 || ^5.0 || ^6.0 || ^7.0 | CVE-2020-5255 | LOW | 1.3% | 4.4.7 | Prevent cache poisoning via a Response Content-Type header in Symfony |
| symfony/http-foundation | ^2.8 || ^3.0 || ^4.0 || ^5.0 || ^6.0 || ^7.0 | CVE-2026-48736 | MODERATE | 0.6% | 6.4.41 | Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpCli... |
| symfony/http-foundation | ^2.8 || ^3.0 || ^4.0 || ^5.0 || ^6.0 || ^7.0 | CVE-2024-50345 | LOW | 0.6% | 5.4.46 | Symfony vulnerable to open redirect via browser-sanitized URLs |
| symfony/cache dev | ^3.4.35 || ^4.3.7 || ^5.0 || ^7.2 | CVE-2026-45073 | MODERATE | 0.5% | 5.4.52 | Symfony Vulnerable to SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix |
| phpunit/phpunit dev | ^6.0 || ^7.0 || ^8.0 || ^9.0 || ^10.0 || ^11.5.3 | CVE-2026-24765 | HIGH | 0.4% | 8.5.52 | PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling |
| doctrine/cache dev | ^1.6 || ^2.2 | CVE-2015-5723 | HIGH | 0.4% | 1.4.2 | Doctrine Security Misconfiguration Vulnerability |
| phpunit/phpunit dev | ^6.0 || ^7.0 || ^8.0 || ^9.0 || ^10.0 || ^11.5.3 | CVE-2026-41570 | HIGH | 0.3% | 12.5.22 | PHPUnit has Argument injection via newline in PHP INI values that are forwarded to child processes |
| codeigniter/framework dev | ~3.0 | GHSA-27qr-636m-wxg2 | CRITICAL | — | 3.1.0 | codeigniter/framework SQL injection in ODBC database driver |
| symfony/http-foundation | ^2.8 || ^3.0 || ^4.0 || ^5.0 || ^6.0 || ^7.0 | CVE-2014-5244 | HIGH | — | 2.3.19 | Symfony vulnerable to denial of service via a malicious HTTP Host header |
| phpunit/phpunit dev | ^6.0 || ^7.0 || ^8.0 || ^9.0 || ^10.0 || ^11.5.3 | GHSA-mh6w-vxff-9wqp | HIGH | — | 12.5.22 | PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes |
| symfony/http-foundation | ^2.8 || ^3.0 || ^4.0 || ^5.0 || ^6.0 || ^7.0 | CVE-2014-6061 | MODERATE | — | 2.3.19 | Symfony has a security issue when parsing the Authorization header |
| symfony/http-foundation | ^2.8 || ^3.0 || ^4.0 || ^5.0 || ^6.0 || ^7.0 | CVE-2015-2309 | MODERATE | — | 2.3.27 | Symfony has unsafe methods in the Request class |
| symfony/http-foundation | ^2.8 || ^3.0 || ^4.0 || ^5.0 || ^6.0 || ^7.0 | GHSA-vfm6-r2gc-pwww | MODERATE | — | 2.0.19 | Symfony2 security issue when the trust proxy mode is enabled |
| codeigniter/framework dev | ~3.0 | GHSA-q9j3-4ghj-6h57 | MODERATE | — | 3.0.3 | Inadequate XSS Prevention in CodeIgniter/Framework Security Library |
| phpunit/phpunit dev | ^6.0 || ^7.0 || ^8.0 || ^9.0 || ^10.0 || ^11.5.3 | CVE-2017-9841 | KEV CRITICAL | 100.0% | 4.8.28 | Code Injection in PHPUnit |
SBOM summary
14 direct dependencies scanned (0 pinned to exact versions) from composer.json. Vulnerability data: OSV.dev · exploitation status: CISA KEV · exploit probability: FIRST EPSS. Findings on unpinned dependencies cover the full constraint range and may not apply to the exact version deployed.
Using ENISA's CRA Maturity Assessment Model for SMEs? This snapshot provides evidence for the Vulnerability Management domain and the product-level technical documentation question (1.3) under Governance & Documentation.
This snapshot is an automated readiness assessment, not legal advice and not a conformity assessment under the CRA.