CVE-2026-73683 | High | 8.1 | 2026-08-14 | Laravel Socialite's Facebook provider contains an authentication bypass vulnerability that allows unauthenticated attackers to replay captured OIDC id_tokens b… |
CVE-2026-39976 | High | 7.1 | 2026-04-09 | Laravel Passport provides OAuth2 server support to Laravel. From 13.0.0 to before 13.7.1, there is an Authentication Bypass for client_credentials tokens. the… |
CVE-2026-23524 | Critical | 9.8 | 2026-01-21 | Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. In versions 1.6.3 and below, Reverb passes data from the Redis ch… |
CVE-2021-47756 | High | 8.4 | 2026-01-16 | Laravel Valet versions 1.1.4 to 2.0.3 contain a local privilege escalation vulnerability that allows users to modify the valet command with root privileges. At… |
CVE-2025-54068 | Critical | 9.8 | 2025-07-17 | Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote c… |
CVE-2024-13919 | High | 8.0 | 2025-03-10 | The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in… |
CVE-2024-13918 | High | 8.0 | 2025-03-10 | The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters i… |
CVE-2025-27515 | Critical | 9.8 | 2025-03-05 | Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*`), a user-crafted malicious request co… |
CVE-2024-55661 | High | 8.8 | 2024-12-13 | Laravel Pulse is a real-time application performance monitoring tool and dashboard for Laravel applications. A vulnerability has been discovered in Laravel Pul… |
CVE-2024-52301 | High | 7.5 | 2024-11-12 | Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, th… |
CVE-2024-50347 | | | 2024-10-31 | Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. Prior to 1.4.0, there is an issue where verification signatures f… |
CVE-2024-47823 | Critical | 9.8 | 2024-10-08 | Livewire is a full-stack framework for Laravel that allows for dynamic UI components without leaving PHP. In livewire/livewire prior to `2.12.7` and `v3.5.2`… |
CVE-2024-21504 | Medium | 6.1 | 2024-03-19 | Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS) when a page uses [Url] for a property. An at… |
CVE-2024-22859 | High | 8.8 | 2024-02-01 | Cross-Site Request Forgery (CSRF) vulnerability in livewire before v3.0.4, allows remote attackers to execute arbitrary code getCsrfToken function. NOTE: the v… |
CVE-2022-40482 | Medium | 5.3 | 2023-04-25 | The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2… |
CVE-2021-28254 | Critical | 9.8 | 2023-04-19 | A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows attackers to execute arbitrary commands. |
CVE-2022-2886 | Medium | 5.0 | 2022-08-19 | A vulnerability, which was classified as critical, was found in Laravel 5.1. Affected is an unknown function. The manipulation leads to deserialization. It is… |
CVE-2022-2870 | Medium | 4.1 | 2022-08-17 | A vulnerability was found in laravel 5.1 and classified as problematic. This issue affects some unknown processing. The manipulation leads to deserialization… |
CVE-2022-25838 | High | 8.1 | 2022-02-24 | Laravel Fortify before 1.11.1 allows reuse within a short time window, thus calling into question the "OT" part of the "TOTP" concept. |
CVE-2020-19316 | High | 8.8 | 2021-12-20 | OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17. |
CVE-2021-43808 | Medium | 5.3 | 2021-12-08 | Laravel is a web application framework. Laravel prior to versions 8.75.0, 7.30.6, and 6.20.42 contain a possible cross-site scripting (XSS) vulnerability in th… |
CVE-2021-43617 | Critical | 9.8 | 2021-11-14 | Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.ph… |
CVE-2021-21263 | High | 7.2 | 2021-01-19 | Laravel is a web application framework. Versions of Laravel before 6.20.11, 7.30.2 and 8.22.1 contain a query binding exploitation. This same exploit applies t… |
CVE-2021-3129 | Critical | 9.8 | 2021-01-12 | Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of fi… |
CVE-2020-24941 | High | 7.5 | 2020-09-04 | An issue was discovered in Laravel before 6.18.35 and 7.x before 7.24.0. The $guarded property is mishandled in some situations involving requests with JSON co… |
CVE-2020-24940 | High | 7.5 | 2020-09-04 | An issue was discovered in Laravel before 6.18.34 and 7.x before 7.23.2. Unvalidated values are saved to the database in some situations in which table names a… |
CVE-2018-6330 | High | 8.8 | 2019-03-28 | Laravel 5.4.15 is vulnerable to Error based SQL injection in save.php via dhx_user and dhx_version parameters. |
CVE-2018-15133 | High | 8.1 | 2018-08-09 | In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X… |
CVE-2017-16894 | High | 7.5 | 2017-11-20 | In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env… |
CVE-2017-14775 | Medium | 5.9 | 2017-09-28 | Laravel before 5.5.10 mishandles the remember_me token verification process because DatabaseUserProvider does not have constant-time token comparison. |
CVE-2017-9303 | Medium | 6.1 | 2017-05-29 | Laravel 5.4.x before 5.4.22 does not properly constrain the host portion of a password-reset URL, which makes it easier for remote attackers to conduct phishin… |