LaraDashboard

Products

ProductCVEsExploitedLatest
LaraDashboard18–Nov 2, 2026

Exploited and recent CVEs

  • CVE-2026-120488 Medium 5.4 LaraDashboard before 1.4.9 Stored XSS via LaraBuilder design_json Block Content 0.2%
  • CVE-2026-120487 High 7.2 LaraDashboard before 1.4.5 Incorrect Authorization via SettingPolicy Core Upgrades 0.5%
  • CVE-2026-120450 Medium 4.3 LaraDashboard 1.4.0 before 1.4.9 Improper Authorization via MCP send-email Tool 0.2%
  • CVE-2026-105130 Low 3.7 LaraDashboard 1.4.0 before 1.4.8 Race Condition Bypasses Per-IP Registration Limit 0.3%
  • CVE-2026-105129 Medium 6.5 LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API 0.3%
  • CVE-2026-105128 Medium 5.4 LaraDashboard before 1.4.8 Open Redirect via Email Template Builder redirect_url 0.3%
  • CVE-2026-105127 Medium 5.3 LaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery Endpoints 0.5%
  • CVE-2026-105126 High 7.2 LaraDashboard before 1.4.8 Privilege Escalation via Superadmin Role Tampering 0.5%
  • CVE-2026-105125 Low 3.7 LaraDashboard before 1.4.8 Path Traversal via /api/translations/{lang} Endpoint 0.3%
  • CVE-2026-90933 High 7.1 laradashboard through 1.2.2 Missing Authorization via License API 0.3%
  • CVE-2026-90932 High 7.2 LaraDashboard 0.9.2 through 1.2.2 Path Traversal RCE 0.8%
  • CVE-2026-90931 Medium 5.4 LaraDashboard 0.9.0 through 1.2.2 Stored XSS via SVG Upload 0.2%
  • CVE-2026-87821 High 7.1 Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch 0.5%
  • CVE-2026-86438 High 7.2 Lara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install Action 1.1%
  • CVE-2026-86437 High 7.2 Lara Dashboard before 1.3.2 Incorrect Authorization in Core-Upgrade Archive Upload 0.7%
  • CVE-2026-86436 Medium 5.4 Lara Dashboard before 1.3.2 Missing Authorization in Post-Builder Media Upload Endpoints 0.5%
  • CVE-2026-86184 Critical 9.8 Lara Dashboard before 1.3.0 Missing Authentication in screenshot-login Route 1.1%
  • CVE-2025-66509 High 8.9 LaraDashboard: 1-Click Pre-Auth RCE via Host Header + Module Installation Chain 0.4%