| CVE-2026-114509 | NGHIÊM TRỌNG9.2 | Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated at | 21/10/2026 |
| CVE-2026-114508 | TRUNG BÌNH6.5 | Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irrever | 21/10/2026 |
| CVE-2026-102279 | THẤP3.1 | Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is fixed in versions 12.69. | 28/09/2026 |
| CVE-2026-48019 | CAO8.9 | Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in ap | 04/09/2026 |
| GHSA-crmm-hgp2-wgrp | TRUNG BÌNH4.2 | Laravel Framework: Temporary Signed URL Path Confusion | 17/06/2026 |
| CVE-2024-13919 | TRUNG BÌNH6.1 | The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in the debug-mode error page. | 10/03/2025 |
| CVE-2024-13918 | TRUNG BÌNH6.1 | The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page. | 10/03/2025 |
| CVE-2025-27515 | NGHIÊM TRỌNG9.8 | Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*`), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1. | 05/03/2025 |
| CVE-2024-52301 | CAO7.5 | Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, an | 12/11/2024 |
| GHSA-wq8p-mqvg-2p5h | CAO | laravel framework SQL Injection via limit and offset functions | 15/05/2024 |
| GHSA-jwvj-pwww-3mj5 | CAO | laravel framework Unexpected database bindings via requests | 15/05/2024 |
| GHSA-44pg-c29v-hp6r | TRUNG BÌNH | Laravel Guard bypass in Eloquent models | 15/05/2024 |
| GHSA-qm5c-m76r-2hfr | NGHIÊM TRỌNG9.9 | Laravel RCE vulnerability in "cookie" session driver | 15/05/2024 |
| GHSA-vr95-p7q6-8m9q | TRUNG BÌNH4.3 | Laravel Cross-site Scripting (XSS) vulnerability in blade templating | 15/05/2024 |
| GHSA-6jvx-8ch9-j2jr | CAO | Laravel Cookie serialization vulnerability | 15/05/2024 |
| GHSA-7852-w36x-6mf6 | TRUNG BÌNH | Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior | 15/05/2024 |
| GHSA-p62r-7637-3wwc | TRUNG BÌNH | Laravel Hijacked authentication cookies vulnerability | 15/05/2024 |
| GHSA-rj3w-99gc-8j58 | TRUNG BÌNH | Laravel Risk of mass-assignment vulnerabilities | 15/05/2024 |
| CVE-2022-40482 | TRUNG BÌNH5.3 | The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\Auth\SessionGuard class when a user is found to not exis | 25/04/2023 |
| CVE-2020-19316 | CAO8.8 | OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17. | 20/12/2021 |