Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

laravel/framework

15 known vulnerabilities (1 critical, 6 high, 3 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
15 · 1 critical, 6 high, 3 medium, 1 low
Registry
Packagist

Advisories 15

  • CVE-2026-114509Critical 9.2

    Laravel TokenGuard authentication bypass through non-string API credentials

    Affected: from 13.0.0, fixed in 13.29.0; fixed in 12.68.0.

  • CVE-2026-114508Medium 6.5

    Laravel relationship inclusion can trigger unauthorized data destruction

    Affected: from 12.45.0, fixed in 12.68.0; from 13.0.0, fixed in 13.27.0.

  • Laravel: XSS in Debug Page Information

    Affected: fixed in 12.69.0; from 13.0.0, fixed in 13.30.0.

  • CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay

    Affected: from 13.0.0, fixed in 13.10.0; fixed in 12.60.0.

  • Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page

    Affected: from 11.9.0, fixed in 11.36.0.

  • Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page

    Affected: from 11.9.0, fixed in 11.36.0.

  • CVE-2025-27515Medium 6.9

    Laravel has a File Validation Bypass

    Affected: from 12.0.0, fixed in 12.1.1; from 11.0.0, fixed in 11.44.1; fixed in 10.48.29.

  • Laravel allows environment manipulation via query string

    Affected: fixed in 6.20.45; from 7.0.0, fixed in 7.30.7; from 8.0.0, fixed in 8.83.28; from 9.0.0, fixed in 9.52.17; from 10.0.0, fixed in 10.48.23; from 11.0.0, fixed in 11.31.0.

  • OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17.

    Affected: fixed in 5.8.17.

  • CVE-2021-43808Medium 5.3

    Blade `@parent` Exploitation Leading To Possible XSS in Laravel

    Affected: fixed in 6.20.42; from 7.0.0, fixed in 7.30.6; from 8.0.0, fixed in 8.75.0.

  • Query Binding Exploitation in Laravel

    Affected: from 8.0.0, fixed in 8.22.1; from 6.0.0, fixed in 6.20.11; from 7.0.0, fixed in 7.30.2.

  • An issue was discovered in Laravel before 6.18.35 and 7.x before 7.24.0.

    Affected: fixed in 6.18.35; from 7.0.0, fixed in 7.24.0.

  • CVE-2018-15133High 8.1 · KEV

    In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a pote

    Affected: through 5.5.40; from 5.6.0, fixed in 5.6.30.

  • Laravel before 5.5.10 mishandles the remember_me token verification process because DatabaseUserProvider does not have constant-time token…

    Affected: fixed in 5.5.10.

  • Laravel 5.4.x before 5.4.22 does not properly constrain the host portion of a password-reset URL, which makes it easier for remote…

    Affected: from 5.3.0, through 5.3.31; from 5.4.0, fixed in 5.4.22.