CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 28/09/2026 |
| CVE-2026-48019 | ALTO8.9 | Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in ap | 04/09/2026 |
| GHSA-crmm-hgp2-wgrp | MEDIO4.2 | Laravel Framework: Temporary Signed URL Path Confusion | 17/06/2026 |
| CVE-2024-13919 | MEDIO6.1 | The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in the debug-mode error page. | 10/03/2025 |
| CVE-2024-13918 | MEDIO6.1 | The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page. | 10/03/2025 |
| CVE-2025-27515 | CRITICO9.8 | Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*`), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1. | 05/03/2025 |
| CVE-2024-52301 | ALTO7.5 | Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, an | 12/11/2024 |
| GHSA-wq8p-mqvg-2p5h | ALTO | laravel framework SQL Injection via limit and offset functions | 15/05/2024 |
| GHSA-jwvj-pwww-3mj5 | ALTO | laravel framework Unexpected database bindings via requests | 15/05/2024 |
| GHSA-44pg-c29v-hp6r | MEDIO | Laravel Guard bypass in Eloquent models | 15/05/2024 |
| GHSA-qm5c-m76r-2hfr | CRITICO9.9 | Laravel RCE vulnerability in "cookie" session driver | 15/05/2024 |
| GHSA-vr95-p7q6-8m9q | MEDIO4.3 | Laravel Cross-site Scripting (XSS) vulnerability in blade templating | 15/05/2024 |
| GHSA-6jvx-8ch9-j2jr | ALTO | Laravel Cookie serialization vulnerability | 15/05/2024 |
| GHSA-7852-w36x-6mf6 | MEDIO | Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior | 15/05/2024 |
| GHSA-p62r-7637-3wwc | MEDIO | Laravel Hijacked authentication cookies vulnerability | 15/05/2024 |
| GHSA-rj3w-99gc-8j58 | MEDIO | Laravel Risk of mass-assignment vulnerabilities | 15/05/2024 |
| CVE-2022-40482 | MEDIO5.3 | The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\Auth\SessionGuard class when a user is found to not exis | 25/04/2023 |
| CVE-2020-19316 | ALTO8.8 | OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17. | 20/12/2021 |