[MEDIUM] Symfony's incorrect argument escaping under MSYS2/Git Bash can lead to destructive file operations on Windows

PKSA-2xjm-ff52-fzd5 CVE-2026-24739 GHSA-r39x-jcww-82v6

Affected version: >=8.0,<8.0.5|>=7.4,<7.4.5|>=7.3,<7.3.11|>=6.4,<6.4.33|<5.4.51

Reported by:
GitHub

[HIGH] CVE-2025-64500: Incorrect parsing of PATH_INFO can lead to limited authorization bypass

PKSA-nqwp-2kdm-491t CVE-2025-64500 GHSA-3rg7-wf37-54rm

Affected version: >=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.50|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.29|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.3.7

Reported by:
GitHub, FriendsOfPHP/security-advisories

CVE-2024-51996: Authentication Bypass via persisted RememberMe cookie

PKSA-yvfh-tnnw-3w9h CVE-2024-51996

Affected version: >=5.3.0,<5.4.0|>=5.4.0,<5.4.47|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.15|>=7.0.0,<7.1.0|>=7.1.0,<7.1.8

Reported by:
FriendsOfPHP/security-advisories

[LOW] CVE-2024-50342: Internal address and port enumeration allowed by NoPrivateNetworkHttpClient

PKSA-vxd1-4ssb-3qdw CVE-2024-50342 GHSA-9c3x-r3wp-mgxm

Affected version: >=4.3.0,<4.4.0|>=4.4.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.47|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.15|>=7.0.0,<7.1.0|>=7.1.0,<7.1.8

Reported by:
GitHub, FriendsOfPHP/security-advisories

[MEDIUM] CVE-2024-50340: Ability to change environment from query

PKSA-2dqt-6z5j-rcvr CVE-2024-50340 GHSA-x8vp-gf4q-mw5j

Affected version: >=5.3.0,<5.4.0|>=5.4.0,<5.4.46|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.14|>=7.0.0,<7.1.0|>=7.1.0,<7.1.7

Reported by:
GitHub, FriendsOfPHP/security-advisories

[HIGH] CVE-2024-51736: Command execution hijack on Windows with Process class

PKSA-jdmc-h4p3-hds2 CVE-2024-51736 GHSA-qq5c-677p-737q

Affected version: >=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.46|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.14|>=7.0.0,<7.1.0|>=7.1.0,<7.1.7

Reported by:
GitHub, FriendsOfPHP/security-advisories

[LOW] CVE-2024-50345: Open redirect via browser-sanitized URLs

PKSA-rb2q-qy38-2dj7 CVE-2024-50345 GHSA-mrqx-rp3w-jpjp

Affected version: >=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.46|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.14|>=7.0.0,<7.1.0|>=7.1.0,<7.1.7

Reported by:
GitHub, FriendsOfPHP/security-advisories

[LOW] CVE-2024-50343: Incorrect response from Validator when input ends with ` `

PKSA-19z7-hn1j-mtcg CVE-2024-50343 GHSA-g3rh-rrhp-jhh9

Affected version: >=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.43|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.11|>=7.0.0,<7.1.0|>=7.1.0,<7.1.4

Reported by:
GitHub, FriendsOfPHP/security-advisories