Laravel Framework vulnerabilities

• flarum framework Laravel TokenGuard authentication bypass through non-string API credentials CVE-2026-114509 Public exploitFix available 9.2 CriticalOctober 21, 2026
• flarum framework Laravel relationship inclusion can trigger unauthorized data destruction CVE-2026-114508 Fix available 6.5 MediumOctober 21, 2026
• flarum framework Laravel: XSS in Debug Page Information CVE-2026-102279 Fix available 3.1 LowSeptember 28, 2026
• flarum framework CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay CVE-2026-48019 Public exploitFix available 8.9 HighJune 17, 2026
• laravel framework Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page CVE-2024-13919 Fix available 8.0 HighMarch 10, 2025
• laravel framework Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page CVE-2024-13918 Fix available 8.0 HighMarch 10, 2025
• laravel framework An issue in Laravel Framework 8 through 11 might allow a remote attacker to discover database... CVE-2024-29291 Public exploitDisputed No scoreApril 16, 2024
• laravel framework The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be... CVE-2022-40482 Fix available 5.3 MediumApril 25, 2023
• flarum framework Laravel has a File Validation Bypass CVE-2025-27515 Public exploitFix available 6.9 MediumApril 29, 2021
• flarum framework, debian linux +1 more Laravel allows environment manipulation via query string CVE-2024-52301 Public exploitFix available EPSS 44.8% 8.7 HighApril 29, 2021
• flarum framework Blade `@parent` Exploitation Leading To Possible XSS in Laravel CVE-2021-43808 Fix available 5.3 MediumApril 29, 2021
• laravel framework Withdrawn: Laravel Framework does not sufficiently block the upload of executable PHP content. CVE-2021-43617 Public exploitFix available EPSS 20.0% 9.8 CriticalApril 29, 2021
• laravel framework SQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/database CVE-2020-19316 Fix available 8.8 HighApril 29, 2021
• flarum framework, laravel +1 more Query Binding Exploitation in Laravel CVE-2021-21263 Fix available 7.2 HighJanuary 19, 2021
• laravel framework Laravel 5.4.15 is vulnerable to Error based SQL injection in save.php via dhx_user and... CVE-2018-6330 8.8 HighMarch 28, 2019
• laravel, laravel framework +1 more Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior CVE-2018-15133 In KEVPublic exploitFix available EPSS 76.6% 8.1 HighAugust 9, 2018