Approved changes feed: RSS · Atom
cpe:2.3:a:laravel:framework:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Laravel (753b10ea-9525-5ae4-bc49-6f2cc8b8ce8c) |
|---|---|
| Product | Framework (272c485d-1118-54f4-a7b1-a5b5ed0750c9) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:composer/laravel/framework |
purl2cpe | 2026-06-01 10:12:10.437139 |
pkg:github/laravel/framework |
purl2cpe | 2026-06-01 10:12:10.437140 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-114508 |
vulnerable | 2026-11-03 10:15:53.388643 |
Laravel relationship inclusion can trigger unauthorized data destruction
MEDIUM (6.5)
Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.
Published: 2026-10-21T21:45:31.465Z
Updated: 2026-10-23T21:18:11.415Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-114509 |
vulnerable | 2026-11-03 10:15:52.820011 |
Laravel TokenGuard authentication bypass through non-string API credentials
Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.
Published: 2026-10-21T21:49:29.486Z
Updated: 2026-10-28T18:32:28.863Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-48019 |
vulnerable | 2026-09-16 04:33:04.133783 |
CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay
HIGH (8.9)
Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses. This issue has been patched in versions 12.60.0 and 13.10.0.
Published: 2026-09-04T22:11:40.811Z
Updated: 2026-09-08T13:01:38.157Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-27515 |
vulnerable | 2026-06-08 07:14:55.259827 |
Laravel has a File Validation Bypass
Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*`), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1.
Published: 2025-03-05T18:45:50.101Z
Updated: 2025-03-05T18:59:49.627Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-52301 |
vulnerable | 2026-06-08 06:52:14.749492 |
Laravel allows environment manipulation via query string
Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, and 11.31.0. The framework now ignores argv values for environment detection on non-cli SAPIs.
Published: 2024-11-12T19:32:14.415Z
Updated: 2024-12-21T17:02:39.839Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-29291 |
vulnerable | 2026-06-08 06:33:29.089833 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-13919 |
vulnerable | 2026-06-08 06:25:38.750526 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-13918 |
vulnerable | 2026-06-08 06:25:38.750053 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-40482 |
vulnerable | 2026-06-08 05:48:24.983926 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-43808 |
vulnerable | 2026-06-08 05:36:44.327813 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-43617 |
vulnerable | 2026-06-08 05:36:43.627815 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21263 |
vulnerable | 2026-06-08 05:29:11.475508 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-19316 |
vulnerable | 2026-06-08 05:20:57.273150 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.