symfony security-http

• CVE-2026-48489 High 8.7 Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes 0.6%
• CVE-2026-45069 High 8.8 Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims 0.3%
• CVE-2026-45075 High 8.3 Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid] 0.4%
• CVE-2026-45074 High 7.6 Symfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay 0.5%