Login Request a demo
CR
Product
CRUD
by Laravel-Backpack · last CVE Sep 14, 2026
10
CVEs
0
On KEV
8.1
Max CVSS
0
New 30D
Vulnerabilities10In the news0Timeline
Severity mix
Critical 0High 4Medium 6Low 0
Severity
All severities10Critical0High4Medium6Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add CRUD to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-54178
8.1
1%
Sep 14
backpack/crud: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
Affected: >= 5.0.0, < 6.0.0; >= 6.0.0, < 6.8.12; >= 7.0.0, < 7.0.35
CVE-2026-54182
8.1
1%
Sep 14
backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)
Affected: < 4.1.70; >= 5.0.0, < 5.6.2; >= 6.0.0, < 6.8.13; >= 7.0.0, < 7.0.36
CVE-2026-54180
7.6
0%
Sep 14
backpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)
Affected: >= 6.0.0, < 6.8.14; >= 7.0.0, < 7.0.38
CVE-2026-54175
7.6
1%
Sep 14
backpack/crud: Unverified password change in MyAccountController via mass assignment
Affected: < 6.8.11; >= 7.0.0, < 7.0.34
Showing 4