| CVE-2026-114509 | 严重9.2 | Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated at | 21/10/2026 |
| CVE-2026-114508 | 中危6.5 | Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irrever | 21/10/2026 |
| CVE-2026-102279 | 低危3.1 | Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is fixed in versions 12.69. | 28/09/2026 |
| CVE-2026-48019 | 高危8.9 | Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in ap | 04/09/2026 |
| GHSA-crmm-hgp2-wgrp | 中危4.2 | Laravel Framework: Temporary Signed URL Path Confusion | 17/06/2026 |
| CVE-2024-13919 | 中危6.1 | The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in the debug-mode error page. | 10/03/2025 |
| CVE-2024-13918 | 中危6.1 | The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page. | 10/03/2025 |
| CVE-2025-27515 | 严重9.8 | Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*`), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1. | 05/03/2025 |
| CVE-2024-52301 | 高危7.5 | Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, an | 12/11/2024 |
| GHSA-wq8p-mqvg-2p5h | 高危 | laravel framework SQL Injection via limit and offset functions | 15/05/2024 |
| GHSA-jwvj-pwww-3mj5 | 高危 | laravel framework Unexpected database bindings via requests | 15/05/2024 |
| GHSA-44pg-c29v-hp6r | 中危 | Laravel Guard bypass in Eloquent models | 15/05/2024 |
| GHSA-qm5c-m76r-2hfr | 严重9.9 | Laravel RCE vulnerability in "cookie" session driver | 15/05/2024 |
| GHSA-vr95-p7q6-8m9q | 中危4.3 | Laravel Cross-site Scripting (XSS) vulnerability in blade templating | 15/05/2024 |
| GHSA-6jvx-8ch9-j2jr | 高危 | Laravel Cookie serialization vulnerability | 15/05/2024 |
| GHSA-7852-w36x-6mf6 | 中危 | Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior | 15/05/2024 |
| GHSA-p62r-7637-3wwc | 中危 | Laravel Hijacked authentication cookies vulnerability | 15/05/2024 |
| GHSA-rj3w-99gc-8j58 | 中危 | Laravel Risk of mass-assignment vulnerabilities | 15/05/2024 |
| CVE-2022-40482 | 中危5.3 | The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\Auth\SessionGuard class when a user is found to not exis | 25/04/2023 |
| CVE-2020-19316 | 高危8.8 | OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17. | 20/12/2021 |