Skip to content
OpenAdvisories

Package · Packagist

laravel/framework

29 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.2
    CVE-2026-114509 Public exploit Scanner template

    Laravel TokenGuard authentication bypass through non-string API credentials

    Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can matc…

    laravel framework laravel/framework php-laravel-framework Debian Packagist
  • Critical 9.9
    GHSA-qm5c-m76r-2hfr

    Laravel RCE vulnerability in "cookie" session driver

    Applications using the "cookie" session driver that were also exposing an encryption oracle via their application were vulnerable to remote code execution. An encryption oracle is a mechanism where arbitrary user input is encrypted and the encrypted string is…

    laravel/framework Packagist