Laravel

Products

Exploited and recent CVEs

• CVE-2026-114509 Critical 9.2 Laravel TokenGuard authentication bypass through non-string API credentials 1.8%
• CVE-2026-114508 Medium 6.5 Laravel relationship inclusion can trigger unauthorized data destruction 0.4%
• CVE-2026-102279 Low 3.1 Laravel: XSS in Debug Page Information 0.3%
• CVE-2026-48019 High 8.9 CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay 0.5%
• CVE-2026-73683 High 8.1 Laravel Socialite Facebook Provider Authentication Bypass via Nonce Replay 0.8%
• CVE-2026-39976 High 7.1 Laravel Passport's TokenGuard Authenticates Unrelated User for Client Credentials Tokens 0.3%
• CVE-2026-23524 Critical 9.8 Laravel Redis Horizontal Scaling Insecure Deserialization 1.0%
• CVE-2021-47756 High 8.4 Laravel Valet 2.0.3 - Local Privilege Escalation (macOS) 0.2%
• CVE-2025-27515 Medium 6.9 Laravel has a File Validation Bypass 0.7%
• CVE-2024-55661 High 8.8 Laravel Pulse Allows Remote Code Execution via Unprotected Query Method 30.6%
• CVE-2024-52301 High 8.7 Laravel allows environment manipulation via query string 44.8%
• CVE-2024-50347 Medium 6.3 Laravel Reverb has Missing API Signature Verification 0.3%
• CVE-2021-43808 Medium 5.3 Blade `@parent` Exploitation Leading To Possible XSS in Laravel 0.8%
• CVE-2021-21263 High 7.2 Query Binding Exploitation in Laravel 1.6%