laravel vulnerabilities

CVEs per yearBy the year they were published

1. 20212
2. 20243
3. 20251
4. 20268

Newest CVEs

• CVE-2026-114509

  Laravel TokenGuard authentication bypass through non-string API credentials

  laravel · framework

  Critical9.2
• CVE-2026-114508

  Laravel relationship inclusion can trigger unauthorized data destruction

  laravel · framework

  Medium6.5
• CVE-2026-102279

  Laravel: XSS in Debug Page Information

  laravel · framework

  Low3.1
• CVE-2026-48019

  CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay

  laravel · framework

  High8.9
• CVE-2026-73683

  Laravel Socialite Facebook Provider Authentication Bypass via Nonce Replay

  Laravel · Socialite

  Critical9.2
• CVE-2026-39976

  Laravel Passport's TokenGuard Authenticates Unrelated User for Client Credentials Tokens

  laravel · passport

  High7.1
• CVE-2026-23524

  Laravel Redis Horizontal Scaling Insecure Deserialization

  laravel · reverb

  Critical9.8
• CVE-2021-47756

  Laravel Valet 2.0.3 - Local Privilege Escalation (macOS)

  Laravel · Laravel Valet

  High8.4
• CVE-2025-27515

  Laravel has a File Validation Bypass

  laravel · framework

  Medium6.9
• CVE-2024-55661

  Laravel Pulse Allows Remote Code Execution via Unprotected Query Method

  laravel · pulse

  High8.7