FR
Product
framework
14
CVEs
0
On KEV
9.8
Max CVSS
2
New 30D
Severity mix
Critical 3High 4Medium 5Low 1
Watch
Add framework to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-27515 | 9.8 | Mar 5 | Laravel has a File Validation Bypass Affected: >= 12.0.0, < 12.1.1; < 11.44.1 |
| CVE-2021-43617 | 9.8 | Nov 14 | Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for… Affected: through 8.70.2 |
| CVE-2026-114509 | 9.2 | Oct 21 | Laravel TokenGuard authentication bypass through non-string API credentials Affected: < 12.68.0; >= 13.0.0, < 13.29.0 |
| CVE-2026-48019 | 8.9 | Sep 4 | CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay Affected: >= 13.0.0, < 13.10.0; < 12.60.0 |
| CVE-2020-19316 | 8.8 | Dec 20 | OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17 Affected: before 5.8.17 |
| CVE-2018-6330 | 8.8 | Mar 28 | Laravel 5.4.15 is vulnerable to Error based SQL injection in save.php via dhx_user and dhx_version parameters Affected: 5.4.15 |
| CVE-2024-52301 | 7.5 | Nov 12 | Laravel allows environment manipulation via query string Affected: < 6.20.45; >= 7.0.0, < 7.30.7; >= 8.0.0, < 8.83.28; >= 9.0.0, < 9.52.17; >= 10.0.0, < 10.48.23; >= 11.0.0, < 11.31.0 |
| CVE-2026-114508 | 6.5 | Oct 21 | Laravel relationship inclusion can trigger unauthorized data destruction Affected: >= 12.45.0, < 12.68.0; >= 13.0.0, < 13.27.0 |
| CVE-2024-13919 | 6.1 | Mar 10 | Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page Affected: 11.9.0 before 11.36.0 |
| CVE-2024-13918 | 6.1 | Mar 10 | Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page Affected: 11.9.0 before 11.36.0 |
| CVE-2021-43808 | 6.1 | Dec 8 | Laravel is a web application framework Affected: before 6.20.42; 7.0.0 before 7.30.6; 8.0.0 before 8.75.0 |
| CVE-2022-40482 | 5.3 | Apr 25 | The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing Affected: 8.0.0 before 8.83.24; 9.0.0 before 9.32.0 |
| CVE-2026-102279 | 3.1 | Sep 28 | Laravel: XSS in Debug Page Information Affected: < 12.69.0; >= 13.0.0, < 13.30.0 |
| CVE-2024-29291 | – | Apr 16 | An issue in Laravel Framework 8 through 11 might allow a remote attacker to discover database credentials in storage/logs/laravel.log Affected: 8 |
Showing 14