Laradashboard vulnerabilities

Products

• Laradashboard 18

Newest

• laradashboard LaraDashboard before 1.4.9 Stored XSS via LaraBuilder design_json Block Content CVE-2026-120488 5.1 MediumNovember 2, 2026
• laradashboard LaraDashboard before 1.4.5 Incorrect Authorization via SettingPolicy Core Upgrades CVE-2026-120487 8.6 HighNovember 2, 2026
• laradashboard LaraDashboard 1.4.0 before 1.4.9 Improper Authorization via MCP send-email Tool CVE-2026-120450 5.3 MediumNovember 2, 2026
• laradashboard LaraDashboard 1.4.0 before 1.4.8 Race Condition Bypasses Per-IP Registration Limit CVE-2026-105130 6.3 MediumOctober 3, 2026
• laradashboard LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API CVE-2026-105129 7.1 HighOctober 3, 2026
• laradashboard LaraDashboard before 1.4.8 Open Redirect via Email Template Builder redirect_url CVE-2026-105128 5.3 MediumOctober 3, 2026
• laradashboard LaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery Endpoints CVE-2026-105127 6.9 MediumOctober 3, 2026
• laradashboard LaraDashboard before 1.4.8 Privilege Escalation via Superadmin Role Tampering CVE-2026-105126 8.6 HighOctober 3, 2026
• laradashboard LaraDashboard before 1.4.8 Path Traversal via /api/translations/{lang} Endpoint CVE-2026-105125 6.3 MediumOctober 3, 2026
• laradashboard laradashboard through 1.2.2 Missing Authorization via License API CVE-2026-90933 7.1 HighSeptember 14, 2026
• laradashboard LaraDashboard 0.9.2 through 1.2.2 Path Traversal RCE CVE-2026-90932 Public exploit 8.6 HighSeptember 14, 2026
• laradashboard LaraDashboard 0.9.0 through 1.2.2 Stored XSS via SVG Upload CVE-2026-90931 Public exploit 5.1 MediumSeptember 14, 2026
• laradashboard Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch CVE-2026-87821 7.1 HighSeptember 9, 2026
• laradashboard Lara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install Action CVE-2026-86438 8.6 HighSeptember 7, 2026
• laradashboard Lara Dashboard before 1.3.2 Incorrect Authorization in Core-Upgrade Archive Upload CVE-2026-86437 8.6 HighSeptember 7, 2026
• laradashboard Lara Dashboard before 1.3.2 Missing Authorization in Post-Builder Media Upload Endpoints CVE-2026-86436 5.3 MediumSeptember 7, 2026
• laradashboard Lara Dashboard before 1.3.0 Missing Authentication in screenshot-login Route CVE-2026-86184 9.3 CriticalSeptember 5, 2026
• laradashboard, laradashboard lara dashboard +1 more LaraDashboard: 1-Click Pre-Auth RCE via Host Header + Module Installation Chain CVE-2025-66509 8.9 HighDecember 4, 2025