What’s Vulnerable › Products
Laravel Framework vulnerabilities
14 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.
Check whether your Laravel Framework version is affected
Latest Laravel Framework vulnerabilities
- CVE-2026-114509 — Laravel TokenGuard authentication bypass through non-string API credentials (CVSS 9.2)
- CVE-2026-114508 — Laravel relationship inclusion can trigger unauthorized data destruction (CVSS 6.5)
- CVE-2026-102279 — Laravel: XSS in Debug Page Information (CVSS 3.1)
- CVE-2026-48019 — CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay (CVSS 8.9)
- CVE-2024-13919 — Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page (CVSS 6.1)
- CVE-2024-13918 — Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page (CVSS 6.1)
- CVE-2025-27515 — Laravel has a File Validation Bypass (CVSS 9.8)
- CVE-2024-52301 — Laravel allows environment manipulation via query string (CVSS 7.5)
- CVE-2024-29291 —
- CVE-2022-40482 — (CVSS 5.3)
- CVE-2020-19316 — (CVSS 8.8)
- CVE-2021-43808 — Blade `@parent` Exploitation Leading To Possible XSS in Laravel (CVSS 6.1)
- CVE-2021-43617 — (CVSS 9.8)
- CVE-2018-6330 — (CVSS 8.8)