Every CVE Search/ Get API key

CVE-2026-102279

Laravel: XSS in Debug Page Information

3.1 LowFix available

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is fixed in versions 12.69.0 and 13.30.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.26%Up 0.1 points since Sep 29, 2026
90%50%10%1%

What each source reports

CVE List Score used 3.1

Laravel: XSS in Debug Page Information

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is fixed in versions 12.69.0 and 13.30.0.

Record
CVE-2026-102279
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-80
Updated
2026-11-02
EUVDEUVD-2026-88508 3.1

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is fixed in versions 12.69.0 and 13.30.0.

Record
EUVD-2026-88508
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-jh5r-qr3c-85q8 3.1

Laravel: XSS in Debug Page Information

Impact

When APP_DEBUG=true, attacker-controlled input is passed to a Tippy.js tooltip configured with allowHTML: true, enabling DOM-based XSS during mouse hover.

Patches

#61381

Record
GHSA-jh5r-qr3c-85q8
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-80
Updated
2026-11-02
NVD 3.1

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is fixed in versions 12.69.0 and 13.30.0.

Record
CVE-2026-102279
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-80
Updated
2026-11-02
OSV 3.1

Laravel: XSS in Debug Page Information

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is fixed in versions 12.69.0 and 13.30.0.

Record
CVE-2026-102279
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-80
Updated
2026-11-02
OSVDEBIAN-CVE-2026-102279 3.1

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is fixed in versions 12.69.0 and 13.30.0.

Record
DEBIAN-CVE-2026-102279
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVGHSA-jh5r-qr3c-85q8 3.1

Laravel: XSS in Debug Page Information

Impact

When APP_DEBUG=true, attacker-controlled input is passed to a Tippy.js tooltip configured with allowHTML: true, enabling DOM-based XSS during mouse hover.

Patches

#61381

Record
GHSA-jh5r-qr3c-85q8
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-80
Updated
2026-11-02
OSVCLSA-2026-1790868507 No score

TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 12.58.0-p4+tuxcare.

Record
CLSA-2026-1790868507
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
laravel/framework
Packagist
 before 12.69.0
12.69.0
laravel/framework
Packagist
 13.0.0 up to 13.30.0
13.30.0
laravel/framework
TuxCare:Packagist
 12.58.0 up to 12.58.0-p4+tuxcare, plus listed versions
12.58.0-p1+tuxcare12.58.0-p2+tuxcare12.58.0-p3+tuxcare
12.58.0-p4+tuxcare
php-laravel-framework
Debian:12
 All versions, plus listed versions
10.48.25+dfsg-110.48.25+dfsg-210.48.29+dfsg-111.44.0-111.44.2+dfsg-1
Show 7 moreShow less
11.46.1+dfsg-111.46.1+dfsg-211.46.1+dfsg-311.46.1+dfsg-413.31.0+dfsg-113.31.0+dfsg-28.83.26+dfsg-2
 None known
php-laravel-framework
Debian:13
 All versions, plus listed versions
10.48.29+dfsg-111.44.0-111.44.2+dfsg-111.46.1+dfsg-111.46.1+dfsg-2
Show 4 moreShow less
11.46.1+dfsg-311.46.1+dfsg-413.31.0+dfsg-113.31.0+dfsg-2
 None known
php-laravel-framework
Debian:14
 before 13.31.0+dfsg-1, plus listed versions
10.48.29+dfsg-111.44.0-111.44.2+dfsg-111.46.1+dfsg-111.46.1+dfsg-211.46.1+dfsg-311.46.1+dfsg-4
13.31.0+dfsg-1
laravel/framework
Packagist
 before 12.69.0, plus listed versions
10.50.25.0.305.2.41v10.0.0v10.0.1
Show 45 moreShow less
v10.0.2v10.0.3v10.1.0v10.1.1v10.1.2v10.1.3v10.1.4v10.1.5v10.10.0v10.10.1v10.11.0v10.12.0v10.13.0v10.13.1v10.13.2v10.13.3v10.13.5v10.14.0v10.14.1v10.15.0v10.16.0v10.16.1v10.17.0v10.17.1v10.18.0v10.19.0v10.2.0v10.20.0v10.21.0v10.21.1v10.22.0v10.23.0v10.23.1v10.24.0v10.25.0v10.25.1v10.25.2v10.26.0v10.26.1v10.26.2v10.27.0v10.28.0v10.29.0v10.3.0v10.3.1
12.69.0
laravel/framework
Packagist
 13.0.0 up to 13.30.0, plus listed versions
v13.0.0v13.1.0v13.1.1v13.10.0v13.11.0
Show 32 moreShow less
v13.11.1v13.11.2v13.12.0v13.13.0v13.14.0v13.15.0v13.16.0v13.16.1v13.17.0v13.18.0v13.18.1v13.19.0v13.2.0v13.20.0v13.21.0v13.21.1v13.22.0v13.23.0v13.24.0v13.25.0v13.26.0v13.26.1v13.27.0v13.28.0v13.29.0v13.3.0v13.4.0v13.5.0v13.6.0v13.7.0v13.8.0v13.9.0
13.30.0

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-102279 is a low vulnerability (CVSS 3.1) in Flarum Framework, published September 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 18th percentile. Fixed in laravel/framework 12.69.0.

References

Show 4 moreShow less
This page doesn't list everything

Left out here: 1,200 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open