Laravel vulnerabilities

Products

• Framework 15
• Laravel 10
• Livewire 4
• Reverb 3
• Passport 2
• Pulse 2

Newest

• flarum framework Laravel TokenGuard authentication bypass through non-string API credentials CVE-2026-114509 Public exploitFix available 9.2 CriticalOctober 21, 2026
• flarum framework Laravel relationship inclusion can trigger unauthorized data destruction CVE-2026-114508 Fix available 6.5 MediumOctober 21, 2026
• flarum framework Laravel: XSS in Debug Page Information CVE-2026-102279 Fix available 3.1 LowSeptember 28, 2026
• laravel pulse rcourtman Pulse Quick Security Setup quick-setup fmt.Sprintf input validation CVE-2026-92860 9.4 CriticalSeptember 17, 2026
• laravel socialite Laravel Socialite Facebook Provider Authentication Bypass via Nonce Replay CVE-2026-73683 9.2 CriticalAugust 14, 2026
• flarum framework CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay CVE-2026-48019 Public exploitFix available 8.9 HighJune 17, 2026
• laravel passport Laravel Passport's TokenGuard Authenticates Unrelated User for Client Credentials Tokens CVE-2026-39976 Fix available 7.1 HighApril 8, 2026
• laravel reverb Laravel Redis Horizontal Scaling Insecure Deserialization CVE-2026-23524 Public exploitFix available 9.8 CriticalJanuary 21, 2026
• laravel valet Laravel Valet 2.0.3 - Local Privilege Escalation (macOS) CVE-2021-47756 8.4 HighJanuary 15, 2026
• laravel livewire Livewire vulnerable to remote command execution during property update hydration CVE-2025-54068 In KEVPublic exploitFix available EPSS 96.3% 9.2 CriticalJuly 17, 2025
• laravel framework Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page CVE-2024-13919 Fix available 8.0 HighMarch 10, 2025
• laravel framework Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page CVE-2024-13918 Fix available 8.0 HighMarch 10, 2025
• laravel pulse Laravel Pulse Allows Remote Code Execution via Unprotected Query Method CVE-2024-55661 Public exploitFix available EPSS 30.6% 8.7 HighDecember 13, 2024
• laravel reverb Laravel Reverb has Missing API Signature Verification CVE-2024-50347 Fix available 6.3 MediumOctober 31, 2024
• laravel livewire Livewire Remote Code Execution (RCE) on File Uploads CVE-2024-47823 Public exploitFix available 7.7 HighOctober 8, 2024
• google reverb Object deserialization in Reverb leading to RCE CVE-2024-8375 5.7 MediumSeptember 19, 2024
• laravel framework An issue in Laravel Framework 8 through 11 might allow a remote attacker to discover database... CVE-2024-29291 Public exploitDisputed No scoreApril 16, 2024
• laravel livewire Cross-site Scripting in livewire/livewire CVE-2024-21504 Fix available 6.1 MediumMarch 19, 2024
• laravel livewire livewire Cross-Site Request Forgery vulnerability CVE-2024-22859 Disputed 8.8 HighFebruary 1, 2024
• laravel framework The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be... CVE-2022-40482 Fix available 5.3 MediumApril 25, 2023
• laravel A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows attackers to... CVE-2021-28254 Fix available 9.8 CriticalApril 18, 2023
• laravel Laravel deserialization CVE-2022-2886 Fix available 5.0 MediumAugust 19, 2022
• laravel laravel deserialization CVE-2022-2870 Fix available 4.1 MediumAugust 17, 2022
• laravel passport Session Fixation CVE-2022-25896 Fix available 4.8 MediumJuly 1, 2022
• laravel fortify Multi-Factor Authentication issue in Laravel Fortify CVE-2022-25838 Fix available 8.1 HighFebruary 24, 2022
• flarum framework Laravel has a File Validation Bypass CVE-2025-27515 Public exploitFix available 6.9 MediumApril 29, 2021
• flarum framework, debian linux +1 more Laravel allows environment manipulation via query string CVE-2024-52301 Public exploitFix available EPSS 44.8% 8.7 HighApril 29, 2021
• flarum framework Blade `@parent` Exploitation Leading To Possible XSS in Laravel CVE-2021-43808 Fix available 5.3 MediumApril 29, 2021
• laravel framework Withdrawn: Laravel Framework does not sufficiently block the upload of executable PHP content. CVE-2021-43617 Public exploitFix available EPSS 20.0% 9.8 CriticalApril 29, 2021
• laravel framework SQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/database CVE-2020-19316 Fix available 8.8 HighApril 29, 2021
• flarum framework, laravel +1 more Query Binding Exploitation in Laravel CVE-2021-21263 Fix available 7.2 HighJanuary 19, 2021
• facade ignition Unauthenticated remote code execution in Ignition CVE-2021-3129 In KEVPublic exploitFix available EPSS 99.9% 9.8 CriticalJanuary 12, 2021
• laravel Guard bypass in Eloquent models affecting Laravel illuminate database component CVE-2020-24940 Fix available 7.5 HighSeptember 4, 2020
• laravel SQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/database CVE-2020-24941 Fix available 7.5 HighSeptember 4, 2020
• laravel framework Laravel 5.4.15 is vulnerable to Error based SQL injection in save.php via dhx_user and... CVE-2018-6330 8.8 HighMarch 28, 2019
• laravel, laravel framework +1 more Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior CVE-2018-15133 In KEVPublic exploitFix available EPSS 76.6% 8.1 HighAugust 9, 2018
• laravel In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as... CVE-2017-16894 Public exploitFix available EPSS 86.9% 7.5 HighNovember 20, 2017
• laravel Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior CVE-2017-14775 Fix available 5.9 MediumSeptember 27, 2017
• laravel Laravel does not properly constrain the host portion of a password-reset URL CVE-2017-9303 Fix available 6.1 MediumMay 29, 2017