Laravel

Vulnerability activity for Laravel: what is being exploited, what was published lately, and when the next patch release is due.

All vendors Open in the dashboard

Last 30 days

CVEs: 0
Critical (CVSS 9+): 0
Exploited (CISA KEV): 0
With exploit code: 0

Last 90 days

CVEs: 2
Critical (CVSS 9+): 0
Exploited (CISA KEV): 0
With exploit code: 0

Last 365 days

CVEs: 5
Critical (CVSS 9+): 2
Exploited (CISA KEV): 1
With exploit code: 1

Exploited now

CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.

9.2CriticalMar 20, 2026Laravel Livewire Code / command injectionCVE-2025-54068Laravel Livewire contain a code injection vulnerability that could allow unauthenticated attackers to achieve remote command execution in specific scenarios.Added to KEV Mar 20, 2026Exploited96% likelyExploit codeNucleiDetection
8.1HighAug 9, 2018Laravel Framework DeserializationCVE-2018-15133Laravel Framework contains a deserialization of untrusted data vulnerability, allowing for remote command execution. This vulnerability may only be exploited if a malicious user has accessed the application encryption key (APP_KEY environment variable).Added to KEV Jan 16, 2024 · 1,985 days after publicationExploited77% likelyExploit codeExploit-DB · Metasploit
9.8CriticalJan 12, 2021Laravel Ignition Path traversal / file handlingCVE-2021-3129Laravel Ignition contains a file upload vulnerability that allows unauthenticated remote attackers to execute malicious code due to insecure usage of file_get_contents() and file_put_contents().Added to KEV Sep 18, 2023 · 978 days after publicationExploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection

Recent

3.1LowSep 28, 2026Laravel framework XSSCVE-2026-102279Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is fixed in versions 12.69.0 and 13.30.0.
8.9HighSep 4, 2026Laravel frameworkCVE-2026-48019Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses. This issue has been patched in versions 12.60.0 and 13.10.0.
7.1HighApr 9, 2026Laravel passport Auth bypass / access controlCVE-2026-39976Laravel Passport provides OAuth2 server support to Laravel. From 13.0.0 to before 13.7.1, there is an Authentication Bypass for client_credentials tokens. the league/oauth2-server library sets the JWT sub claim to the client identifier (since there's no user). The token guard then passes this value to retrieveById() without validating it's actually a user identifier, potentially resolving an unrelated real user. Any machine-to-machine token can inadvertently authenticate as an actual user. This
9.2CriticalMar 20, 2026Laravel Livewire Code / command injectionCVE-2025-54068Laravel Livewire contain a code injection vulnerability that could allow unauthenticated attackers to achieve remote command execution in specific scenarios.Exploited96% likelyExploit codeNucleiDetection
9.8CriticalJan 21, 2026Laravel reverb DeserializationCVE-2026-23524Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. In versions 1.6.3 and below, Reverb passes data from the Redis channel directly into PHP’s unserialize() function without restricting which classes can be instantiated, which leaves users vulnerable to Remote Code Execution. The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication, but only affects Laravel Reverb when horizontal scaling is
8.1HighAug 9, 2018Laravel Framework DeserializationCVE-2018-15133Laravel Framework contains a deserialization of untrusted data vulnerability, allowing for remote command execution. This vulnerability may only be exploited if a malicious user has accessed the application encryption key (APP_KEY environment variable).Exploited77% likelyExploit codeExploit-DB · Metasploit
9.8CriticalJan 12, 2021Laravel Ignition Path traversal / file handlingCVE-2021-3129Laravel Ignition contains a file upload vulnerability that allows unauthenticated remote attackers to execute malicious code due to insecure usage of file_get_contents() and file_put_contents().Exploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection

See every Laravel entry on the dashboard.