Skip to content
OpenAdvisories

Vendor

laravel

14 known vulnerabilities.

Products

framework 8 reverb 2 Laravel Valet 1 pulse 1 Socialite 1 passport 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.2
    CVE-2026-114509 Public exploit Scanner template

    Laravel TokenGuard authentication bypass through non-string API credentials

    Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can matc…

    laravel framework laravel/framework php-laravel-framework Debian Packagist
  • High 8.9
    CVE-2026-48019 Public exploit

    CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay

    Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticat…

    laravel framework laravel/framework php-laravel-framework Debian Packagist
  • Critical 9.8
    CVE-2026-23524 Public exploit

    Laravel Redis Horizontal Scaling Insecure Deserialization

    Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. In versions 1.6.3 and below, Reverb passes data from the Redis channel directly into PHP’s unserialize() function without restricting which classes can be instantiat…

    laravel reverb laravel/reverb Packagist
  • Medium 6.9
    CVE-2025-27515 Public exploit

    Laravel has a File Validation Bypass

    Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*`), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1.

    laravel framework laravel/framework php-laravel-framework Debian Packagist
  • High 8.7
    CVE-2024-55661 Public exploit EPSS 31%

    Laravel Pulse Allows Remote Code Execution via Unprotected Query Method

    Laravel Pulse is a real-time application performance monitoring tool and dashboard for Laravel applications. A vulnerability has been discovered in Laravel Pulse prior to version 1.3.1 that could allow remote code execution through the public `remember()` met…

    laravel pulse laravel/pulse Packagist
  • High 8.7
    CVE-2024-52301 Public exploit EPSS 45%

    Laravel allows environment manipulation via query string

    Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerabi…

    laravel framework laravel/framework php-laravel-framework Debian Packagist