[ Vendor · 6 CVEs ]
laravel
CVEs affecting laravel published in the last 30 days, plus any laravel CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-114508 | 21 Oct 2026 | CVSS 6.5 | laravel frameworkLaravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a… | |
| CVE-2026-114509 | 21 Oct 2026 | CVSS 9.2 | laravel frameworkLaravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a… | |
| CVE-2026-102279 | 28 Sep 2026 | CVSS 3.1 | Laravel: XSS in Debug Page InformationLaravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled… | Fix |
| CVE-2025-54068 | 17 Jul 2025 | CVSS 9.8 | Laravel Livewire Code InjectionLivewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to… | ExploitedFix |
| CVE-2021-3129 | 12 Jan 2021 | CVSS 9.8 | Laravel Ignition File UploadIgnition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure… | ExploitedFix |
| CVE-2018-15133 | 9 Aug 2018 | CVSS 8.1 | Laravel Deserialization of Untrusted DataIn Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially… | Exploited |