laradashboard vulnerabilities

15 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 13 published in the last 12 months.

Latest laradashboard vulnerabilities

CVE-2026-105130 — LaraDashboard 1.4.0 before 1.4.8 Race Condition Bypasses Per-IP Registration Limit (CVSS 3.7)
CVE-2026-105129 — LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API (CVSS 6.5)
CVE-2026-105128 — LaraDashboard before 1.4.8 Open Redirect via Email Template Builder redirect_url (CVSS 5.4)
CVE-2026-105127 — LaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery Endpoints (CVSS 5.3)
CVE-2026-105126 — LaraDashboard before 1.4.8 Privilege Escalation via Superadmin Role Tampering (CVSS 7.2)
CVE-2026-105125 — LaraDashboard before 1.4.8 Path Traversal via /api/translations/{lang} Endpoint (CVSS 3.7)
CVE-2026-90933 — laradashboard through 1.2.2 Missing Authorization via License API (CVSS 7.1)
CVE-2026-87821 — Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch (CVSS 7.1)
CVE-2026-86438 — Lara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install Action (CVSS 7.2)
CVE-2026-86437 — Lara Dashboard before 1.3.2 Incorrect Authorization in Core-Upgrade Archive Upload (CVSS 7.2)
CVE-2026-86436 — Lara Dashboard before 1.3.2 Missing Authorization in Post-Builder Media Upload Endpoints (CVSS 5.4)
CVE-2026-86184 — Lara Dashboard before 1.3.0 Missing Authentication in screenshot-login Route (CVSS 9.8)
CVE-2025-66509 — LaraDashboard: 1-Click Pre-Auth RCE via Host Header + Module Installation Chain (CVSS 9.8)