Skip to content
OpenAdvisories

Vendor

laravel

14 known vulnerabilities.

Products

framework 8 reverb 2 Laravel Valet 1 pulse 1 Socialite 1 passport 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 8.9
    CVE-2026-48019 Public exploit

    CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay

    Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticat…

    laravel framework laravel/framework php-laravel-framework Debian Packagist
  • High 8.1
    CVE-2026-73683

    Laravel Socialite Facebook Provider Authentication Bypass via Nonce Replay

    Laravel Socialite's Facebook provider contains an authentication bypass vulnerability that allows unauthenticated attackers to replay captured OIDC id_tokens by exploiting the missing nonce claim validation in the getUserByOIDCToken() function within Facebook…

    laravel Socialite
  • High 7.1
    CVE-2026-39976

    Laravel Passport's TokenGuard Authenticates Unrelated User for Client Credentials Tokens

    Laravel Passport provides OAuth2 server support to Laravel. From 13.0.0 to before 13.7.1, there is an Authentication Bypass for client_credentials tokens. the league/oauth2-server library sets the JWT sub claim to the client identifier (since there's no user)…

    laravel passport laravel/passport Packagist
  • High 8.4
    CVE-2021-47756

    Laravel Valet 2.0.3 - Local Privilege Escalation (macOS)

    Laravel Valet versions 1.1.4 to 2.0.3 contain a local privilege escalation vulnerability that allows users to modify the valet command with root privileges. Attackers can edit the symlinked valet command to execute arbitrary code with root permissions without…

    laravel Laravel Valet
  • High 8.7
    CVE-2024-55661 Public exploit EPSS 31%

    Laravel Pulse Allows Remote Code Execution via Unprotected Query Method

    Laravel Pulse is a real-time application performance monitoring tool and dashboard for Laravel applications. A vulnerability has been discovered in Laravel Pulse prior to version 1.3.1 that could allow remote code execution through the public `remember()` met…

    laravel pulse laravel/pulse Packagist
  • High 8.7
    CVE-2024-52301 Public exploit EPSS 45%

    Laravel allows environment manipulation via query string

    Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerabi…

    laravel framework laravel/framework php-laravel-framework Debian Packagist
  • High 7.2
    CVE-2021-21263

    Query Binding Exploitation in Laravel

    Laravel is a web application framework. Versions of Laravel before 6.20.11, 7.30.2 and 8.22.1 contain a query binding exploitation. This same exploit applies to the illuminate/database package which is used by Laravel. If a request is crafted where a field th…

    laravel framework laravel/framework php-laravel-framework Debian Packagist