LA
Vendor
Laravel
37
CVEs
4
On KEV
2
New 30D
Products
FR9.8
framework
laravel
14 CVEs0 on KEV2 new
LA9.8
Laravel
Laravel
10 CVEs1 on KEV0 new
LI9.8
Livewire
Laravel
4 CVEs1 on KEV0 new
IG9.8
Ignition
Laravel
1 CVEs1 on KEV0 new
LF8.1
Laravel Framework
Laravel
1 CVEs1 on KEV0 new
RE9.8
reverb
laravel
2 CVEs0 on KEV0 new
FO8.1
Fortify
Laravel
1 CVEs0 on KEV0 new
LV8.4
Laravel Valet
Laravel
1 CVEs0 on KEV0 new
PA7.1
passport
laravel
1 CVEs0 on KEV0 new
PU8.8
pulse
laravel
1 CVEs0 on KEV0 new
SO8.1
Socialite
Laravel
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-114509 | FR framework laravel | 9.2 | Oct 21 | Laravel TokenGuard authentication bypass through non-string API credentials |
| CVE-2026-114508 | FR framework laravel | 6.5 | Oct 21 | Laravel relationship inclusion can trigger unauthorized data destruction |
| CVE-2026-102279 | FR framework laravel | 3.1 | Sep 28 | Laravel: XSS in Debug Page Information |
| CVE-2026-48019 | FR framework laravel | 8.9 | Sep 4 | CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay |
| CVE-2026-73683 | SO Socialite Laravel | 8.1 | Aug 14 | Laravel Socialite Facebook Provider Authentication Bypass via Nonce Replay |
| CVE-2026-39976 | PA passport laravel | 7.1 | Apr 9 | Laravel Passport's TokenGuard Authenticates Unrelated User for Client Credentials Tokens |
| CVE-2026-23524 | RE reverb laravel | 9.8 | Jan 21 | Laravel Redis Horizontal Scaling Insecure Deserialization |
| CVE-2021-47756 | LV Laravel Valet Laravel | 8.4 | Jan 15 | Laravel Valet 2.0.3 - Local Privilege Escalation (macOS) |
| CVE-2025-54068 In wildKEV | LI Livewire Laravel | 9.8 | Jul 17 | Livewire vulnerable to remote command execution during property update hydration |
| CVE-2024-13919 | FR Framework Laravel | 6.1 | Mar 10 | Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page |
| CVE-2024-13918 | FR Framework Laravel | 6.1 | Mar 10 | Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page |
| CVE-2025-27515 | FR framework laravel | 9.8 | Mar 5 | Laravel has a File Validation Bypass |
| CVE-2024-55661 | PU pulse laravel | 8.8 | Dec 13 | Laravel Pulse Allows Remote Code Execution via Unprotected Query Method |
| CVE-2024-52301 | FR framework laravel | 7.5 | Nov 12 | Laravel allows environment manipulation via query string |
| CVE-2024-50347 | RE reverb laravel | 6.3 | Oct 31 | Laravel Reverb has Missing API Signature Verification |
| CVE-2024-47823 | LI Livewire Laravel | 9.8 | Oct 8 | Livewire Remote Code Execution (RCE) on File Uploads |
| CVE-2024-29291 | FR Framework Laravel | – | Apr 16 | An issue in Laravel Framework 8 through 11 might allow a remote attacker to discover database credentials in storage/logs/laravel.log |
| CVE-2024-21504 | LI Livewire Laravel | 6.1 | Mar 19 | Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS) when a page uses [Url] for a property |
| CVE-2024-22859 | LI Livewire Laravel | 8.8 | Feb 1 | Cross-Site Request Forgery (CSRF) vulnerability in livewire before v3.0.4, allows remote attackers to execute arbitrary code getCsrfToken function |
| CVE-2022-40482 | FR Framework Laravel | 5.3 | Apr 25 | The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing |
| CVE-2021-28254 | LA Laravel Laravel | 9.8 | Apr 18 | A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows attackers to execute arbitrary commands |
| CVE-2022-2886 | LA Laravel Laravel | 8.8 | Aug 19 | Laravel deserialization |
| CVE-2022-2870 | LA Laravel Laravel | 9.8 | Aug 17 | laravel deserialization |
| CVE-2022-25838 | FO Fortify Laravel | 8.1 | Feb 24 | Laravel Fortify before 1.11.1 allows reuse within a short time window, thus calling into question the "OT" part of the "TOTP" concept |
| CVE-2020-19316 | FR Framework Laravel | 8.8 | Dec 20 | OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17 |
| CVE-2021-43808 | FR framework laravel | 6.1 | Dec 7 | Blade `@parent` Exploitation Leading To Possible XSS in Laravel |
| CVE-2021-43617 | FR Framework Laravel | 9.8 | Nov 14 | Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for… |
| CVE-2021-21263 | LA Laravel Laravel | 5.3 | Jan 19 | Laravel is a web application framework |
| CVE-2021-3129 RansomwareIn wildKEV | IG Ignition Laravel | 9.8 | Jan 12 | Laravel Ignition File Upload Vulnerability |
| CVE-2020-24941 | LA Laravel Laravel | 7.5 | Sep 4 | An issue was discovered in Laravel before 6.18.35 and 7.x before 7.24.0 |
| CVE-2020-24940 | LA Laravel Laravel | 7.5 | Sep 4 | An issue was discovered in Laravel before 6.18.34 and 7.x before 7.23.2 |
| CVE-2018-6330 | FR Framework Laravel | 8.8 | Mar 28 | Laravel 5.4.15 is vulnerable to Error based SQL injection in save.php via dhx_user and dhx_version parameters |
| CVE-2018-15133 In wildKEV | LA Laravel Laravel | 8.1 | Aug 9 | In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value |
| CVE-2017-16894 | LA Laravel Laravel | 7.5 | Nov 20 | In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env URI |
| CVE-2017-14775 | LA Laravel Laravel | 5.9 | Sep 28 | Laravel before 5.5.10 mishandles the remember_me token verification process because DatabaseUserProvider does not have constant-time token comparison |
| CVE-2017-9303 | LA Laravel Laravel | 6.1 | May 29 | Laravel 5.4.x before 5.4.22 does not properly constrain the host portion of a password-reset URL, which makes it easier for remote attackers to conduct phishing attacks by… |