laravel framework vulnerabilities

CVEs per yearBy the year they were published

1. 20212
2. 20241
3. 20251
4. 20264

Newest CVEs

• CVE-2026-114509

  Laravel TokenGuard authentication bypass through non-string API credentials

  laravel · framework

  Critical9.2
• CVE-2026-114508

  Laravel relationship inclusion can trigger unauthorized data destruction

  laravel · framework

  Medium6.5
• CVE-2026-102279

  Laravel: XSS in Debug Page Information

  laravel · framework

  Low3.1
• CVE-2026-48019

  CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay

  laravel · framework

  High8.9
• CVE-2025-27515

  Laravel has a File Validation Bypass

  laravel · framework

  Medium6.9
• CVE-2024-52301

  Laravel allows environment manipulation via query string

  laravel · framework

  High8.7
• CVE-2021-43808

  Blade `@parent` Exploitation Leading To Possible XSS in Laravel

  laravel · framework

  Medium5.3
• CVE-2021-21263

  Query Binding Exploitation in Laravel

  laravel · framework

  High7.2