Laravel Livewire
4 CVEs affecting Laravel Livewire. Latest disclosed: 2025-07-17. Critical: 2, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-54068 | Critical | 9.8 | 2025-07-17 | Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote c… |
CVE-2024-47823 | Critical | 9.8 | 2024-10-08 | Livewire is a full-stack framework for Laravel that allows for dynamic UI components without leaving PHP. In livewire/livewire prior to `2.12.7` and `v3.5.2`… |
CVE-2024-22859 | High | 8.8 | 2024-02-01 | Cross-Site Request Forgery (CSRF) vulnerability in livewire before v3.0.4, allows remote attackers to execute arbitrary code getCsrfToken function. NOTE: the v… |
CVE-2024-21504 | Medium | 6.1 | 2024-03-19 | Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS) when a page uses [Url] for a property. An at… |