laravel vulnerabilities
14 published CVEs name laravel among the affected products.
- 14Published CVEs14 of them scored
- 8Last 12 monthspublished in the last year
- 3Critical6 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-114509
Laravel TokenGuard authentication bypass through non-string API credentials
laravel · framework
Critical9.2 - CVE-2026-114508
Laravel relationship inclusion can trigger unauthorized data destruction
laravel · framework
Medium6.5 - CVE-2026-102279
Laravel: XSS in Debug Page Information
laravel · framework
Low3.1 - CVE-2026-48019
CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay
laravel · framework
High8.9 - CVE-2026-73683
Laravel Socialite Facebook Provider Authentication Bypass via Nonce Replay
Laravel · Socialite
Critical9.2 - CVE-2026-39976
Laravel Passport's TokenGuard Authenticates Unrelated User for Client Credentials Tokens
laravel · passport
High7.1 - CVE-2026-23524
Laravel Redis Horizontal Scaling Insecure Deserialization
laravel · reverb
Critical9.8 - CVE-2021-47756
Laravel Valet 2.0.3 - Local Privilege Escalation (macOS)
Laravel · Laravel Valet
High8.4 - CVE-2025-27515
Laravel has a File Validation Bypass
laravel · framework
Medium6.9 - CVE-2024-55661
Laravel Pulse Allows Remote Code Execution via Unprotected Query Method
laravel · pulse
High8.7