CVE-2026-105130 | Low | 3.7 | 2026-10-04 | LaraDashboard from 1.4.0 before 1.4.8 contains a race condition vulnerability in RegisterController::register that allows unauthenticated attackers to bypass t… |
CVE-2026-105129 | Medium | 6.5 | 2026-10-04 | LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored… |
CVE-2026-105128 | Medium | 5.4 | 2026-10-04 | LaraDashboard before 1.4.8 contains an open redirect vulnerability that allows remote attackers to redirect users by supplying an unvalidated redirect_url para… |
CVE-2026-105127 | Medium | 5.3 | 2026-10-04 | LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS lookups and p… |
CVE-2026-105126 | High | 7.2 | 2026-10-04 | LaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows authenticated Admin users to escalate to Superadmin by editing o… |
CVE-2026-105125 | Low | 3.7 | 2026-10-04 | LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating the {lang} route se… |
CVE-2026-90933 | High | 7.1 | 2026-09-14 | laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overw… |
CVE-2026-90932 | High | 7.2 | 2026-09-14 | LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in the core-upgrade backup handling. CoreUpgradeController and BackupService… |
CVE-2026-90931 | Medium | 5.4 | 2026-09-14 | LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated users with only the media.create permi… |
CVE-2026-87821 | High | 7.1 | 2026-09-09 | Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authen… |
CVE-2026-86438 | High | 7.2 | 2026-09-07 | Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install mo… |
CVE-2026-86437 | High | 7.2 | 2026-09-07 | Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin a… |
CVE-2026-86436 | Medium | 5.4 | 2026-09-07 | Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content per… |
CVE-2026-86184 | Critical | 9.8 | 2026-09-05 | Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate… |
CVE-2025-66509 | Critical | 9.8 | 2025-12-04 | LaraDashboard is an all-In-one solution to start a Laravel Application. In 2.3.0 and earlier, the password reset flow trusts the Host header, allowing attacker… |