CVE 検索
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
| 28/09/2026 |
| CVE-2026-48019 | 高8.9 | Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in ap | 04/09/2026 |
| GHSA-crmm-hgp2-wgrp | 中4.2 | Laravel Framework: Temporary Signed URL Path Confusion | 17/06/2026 |
| CVE-2024-13919 | 中6.1 | The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in the debug-mode error page. | 10/03/2025 |
| CVE-2024-13918 | 中6.1 | The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page. | 10/03/2025 |
| CVE-2025-27515 | 緊急9.8 | Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*`), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1. | 05/03/2025 |
| CVE-2024-52301 | 高7.5 | Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, an | 12/11/2024 |
| GHSA-wq8p-mqvg-2p5h | 高 | laravel framework SQL Injection via limit and offset functions | 15/05/2024 |
| GHSA-jwvj-pwww-3mj5 | 高 | laravel framework Unexpected database bindings via requests | 15/05/2024 |
| GHSA-44pg-c29v-hp6r | 中 | Laravel Guard bypass in Eloquent models | 15/05/2024 |
| GHSA-qm5c-m76r-2hfr | 緊急9.9 | Laravel RCE vulnerability in "cookie" session driver | 15/05/2024 |
| GHSA-vr95-p7q6-8m9q | 中4.3 | Laravel Cross-site Scripting (XSS) vulnerability in blade templating | 15/05/2024 |
| GHSA-6jvx-8ch9-j2jr | 高 | Laravel Cookie serialization vulnerability | 15/05/2024 |
| GHSA-7852-w36x-6mf6 | 中 | Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior | 15/05/2024 |
| GHSA-p62r-7637-3wwc | 中 | Laravel Hijacked authentication cookies vulnerability | 15/05/2024 |
| GHSA-rj3w-99gc-8j58 | 中 | Laravel Risk of mass-assignment vulnerabilities | 15/05/2024 |
| CVE-2020-19316 | 高8.8 | OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17. | 20/12/2021 |
| CVE-2021-43808 | 中6.1 | Laravel is a web application framework. Laravel prior to versions 8.75.0, 7.30.6, and 6.20.42 contain a possible cross-site scripting (XSS) vulnerability in the Blade templating engine. A broken HTML element may be clicked and the user taken to another location in their browser due to XSS. This is due to the user being | 08/12/2021 |