Composer laravel/framework has 38 known advisories in the phpwarden feed, 1 actively exploited. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2018-15133 KEV | Laravel Framework RCE Vulnerability | high | 8.1 | <=5.5.40 or >=5.6.0 and <5.6.30 | 5.6.30 |
| CVE-2024-52301 | Laravel environment manipulation via query string | high | 0.0 | <6.20.45 or >=7.0.0 and <7.30.7 or >=8.0.0 and <8.83.28 or >=9.0.0 and <9.52.17 or >=10.0.0 and <10.48.23 or >=11.0.0 and <11.31.0 | 6.20.45, 7.30.7, 8.83.28, 9.52.17 |
| CVE-2021-43617 | Image upload bypass | unknown | 0.0 | >=8.0.0 and <8.71.0 | 8.71.0 |
| CVE-2020-19316 | OS Command Injection in Laravel Framework | high | 8.8 | <5.8.17 | 5.8.17 |
| CVE-2021-21263 | Query Binding Exploitation | high | 7.2 | >=8.0.0 and <8.22.1 or >=6.0.0 and <6.20.11 or >=7.0.0 and <7.30.2 | 8.22.1, 6.20.11, 7.30.2 |
| CVE-2017-14775 | Laravel Sensitive Data Exposure | medium | 5.9 | <5.5.10 or >=4.1.26 and <=4.1.31 or >=4.2.0 and <=4.2.22 or >=5.0.0 and <=5.0.35 or >=5.1.0 and <=5.1.46 or >=5.2.0 and <=5.2.45 or >=5.3.0 and <=5.3.31 or >=5.4.0 and <=5.4.36 or >=5.5.0 and <5.5.10 | 5.5.10 |
| CVE-2020-24941 | Improper Input Validation in Laravel | high | 7.5 | <6.18.35 or >=7.0.0 and <7.24.0 | 6.18.35, 7.24.0 |
| CVE-2017-9303 | Laravel does not properly constrain the host portion of a password-reset URL | medium | 6.1 | >=5.3.0 and <=5.3.31 or >=5.4.0 and <5.4.22 | 5.4.22 |
| CVE-2021-43808 | Laravel Framework XSS in Blade templating engine | medium | 6.1 | <6.20.42 or >=7.0.0 and <7.30.6 or >=8.0.0 and <8.75.0 | 6.20.42, 7.30.6, 8.75.0 |
| CVE-2026-114509 | Laravel TokenGuard authentication bypass through non-string API credentials | critical | 0.0 | >=13.0.0 and <13.29.0 or <12.68.0 | 13.29.0, 12.68.0 |
| CVE-2025-27515 | Laravel has a File Validation Bypass | medium | 0.0 | >=12.0.0 and <12.1.1 or >=11.0.0 and <11.44.1 or <10.48.29 | 12.1.1, 11.44.1, 10.48.29 |
| CVE-2024-13918 | Laravel framework susceptible to reflected cross-site scripting | medium | 4.7 | >=11.9.0 and <11.36.0 | 11.36.0 |
| CVE-2024-13919 | Laravel framework susceptible to reflected cross-site scripting | medium | 4.7 | >=11.9.0 and <11.36.0 | 11.36.0 |
| CVE-2026-48019 | Laravel Framework: CRLF injection in default email rule | high | 8.9 | >=13.0.0 and <13.10.0 or <12.60.0 or >=9.0.0 and <10.0.0 or >=10.0.0 and <11.0.0 or >=11.0.0 and <12.0.0 or >=12.0.0 and <12.60.0 | 13.10.0, 12.60.0 |
| CVE-2026-114508 | Laravel relationship inclusion can trigger unauthorized data destruction | medium | 6.5 | >=12.45.0 and <12.68.0 or >=13.0.0 and <13.27.0 | 12.68.0, 13.27.0 |
| CVE-2026-102279 | Laravel: XSS in Debug Page Information | low | 3.1 | <12.69.0 or >=13.0.0 and <13.30.0 | 12.69.0, 13.30.0 |
| GHSA-qm5c-m76r-2hfr | Laravel RCE vulnerability in "cookie" session driver | critical | 9.9 | >=4.1.0 and <6.18.31 or >=7.0.0 and <7.22.4 | 6.18.31, 7.22.4 |
| CVE-2019-9081 | Laravel Framework Deserialization Vulnerability | critical | 9.8 | >=5.7.0 and <6.20.44 | 6.20.44 |
| GHSA-x7p5-p2c9-phvg | Unexpected database bindings | high | 7.2 | <6.20.14 or >=7.0.0 and <7.30.4 or >=8.0.0 and <8.24.0 | 6.20.14, 7.30.4, 8.24.0 |
| GHSA-vr95-p7q6-8m9q | Laravel Cross-site Scripting (XSS) vulnerability in blade templating | medium | 4.3 | >=7.0.0 and <7.1.2 | 7.1.2 |
| GHSA-crmm-hgp2-wgrp | Laravel Framework: Temporary Signed URL Path Confusion | medium | 4.2 | >=13.0.0 and <13.12.0 or <12.61.1 | 13.12.0, 12.61.1 |
| 2014-04-15 | Hijacked authentication cookies vulnerability | unknown | 0.0 | >=4.0.0 and <4.0.99 or >=4.1.0 and <4.1.26 | 4.0.99, 4.1.26 |
| 2014-05-20 | Risk of mass-assignment vulnerabilities | unknown | 0.0 | >=4.0.0 and <4.0.99 or >=4.1.0 and <4.1.29 | 4.0.99, 4.1.29 |
| 2018-03-30-1 | Exploit of encryption failure vulnerability | unknown | 0.0 | >=4.0.0 and <=4.0.11 or >=4.1.0 and <=4.1.31 or >=4.2.0 and <=4.2.22 or >=5.0.0 and <=5.0.35 or >=5.1.0 and <=5.1.46 or >=5.2.0 and <=5.2.45 or >=5.3.0 and <=5.3.31 or >=5.4.0 and <=5.4.36 or >=5.5.0 and <5.5.40 or >=5.6.0 and <5.6.15 | 5.5.40, 5.6.15 |
| 2018-08-08-1 | Cookie serialization vulnerability | unknown | 0.0 | >=4.0.0 and <=4.0.11 or >=4.1.0 and <=4.1.31 or >=4.2.0 and <=4.2.22 or >=5.0.0 and <=5.0.35 or >=5.1.0 and <=5.1.46 or >=5.2.0 and <=5.2.45 or >=5.3.0 and <=5.3.31 or >=5.4.0 and <=5.4.36 or >=5.5.0 and <5.5.42 or >=5.6.0 and <5.6.30 | 5.5.42, 5.6.30 |
| 2020-03-13-1 | XSS vulnerability in blade templating | unknown | 0.0 | >=7.0.0 and <7.1.2 | 7.1.2 |
| 2020-07-27-1 | RCE vulnerability in "cookie" session driver | unknown | 0.0 | >=4.1.0 and <=4.1.99999 or >=4.2.0 and <=4.2.99999 or >=5.0.0 and <=5.0.99999 or >=5.1.0 and <=5.1.99999 or >=5.2.0 and <=5.2.99999 or >=5.3.0 and <=5.3.99999 or >=5.4.0 and <=5.4.99999 or >=5.5.0 and <=5.5.49 or >=5.6.0 and <=5.6.99999 or >=5.7.0 and <=5.7.99999 or >=5.8.0 and <=5.8.99999 or >=6.0.0 and <6.18.31 or >=7.0.0 and <7.22.4 | 6.18.31, 7.22.4 |
| 2020-08-06-1 | Guard bypass in Eloquent models | unknown | 0.0 | >=5.5.0 and <=5.5.49 or >=6.0.0 and <6.18.34 or >=7.0.0 and <7.23.2 | 6.18.34, 7.23.2 |
| 2021-01-21 | Unexpected bindings in QueryBuilder | unknown | 0.0 | >=6.0.0 and <6.20.14 or >=7.0.0 and <7.30.4 or >=8.0.0 and <8.24.0 | 6.20.14, 7.30.4, 8.24.0 |
| 2021-04-28 | SQL Server LIMIT / OFFSET SQL Injection | unknown | 0.0 | >=6.0.0 and <6.20.26 or >=7.0.0 and <7.30.5 or >=8.0.0 and <8.40.0 | 6.20.26, 8.40.0 |
| GHSA-44pg-c29v-hp6r | Laravel Guard bypass in Eloquent models | medium | 0.0 | >=5.5.0 and <=5.5.49 or >=6.0.0 and <6.18.34 or >=7.0.0 and <7.23.2 | 6.18.34, 7.23.2 |
| GHSA-4mg9-vhxq-vm7j | SQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/database | high | 0.0 | >=8.0.0 and <8.40.0 or <6.20.26 | 8.40.0, 6.20.26 |
| GHSA-6jvx-8ch9-j2jr | Laravel Cookie serialization vulnerability | high | 0.0 | >=5.5.0 and <5.6.30 | 5.6.30 |
| GHSA-7852-w36x-6mf6 | Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior | medium | 0.0 | <5.5.40 or >=5.6.0 and <5.6.15 | 5.5.40, 5.6.15 |
| GHSA-jwvj-pwww-3mj5 | laravel framework Unexpected database bindings via requests | high | 0.0 | >=6.0.0 and <6.20.14 or >=7.0.0 and <7.30.4 or >=8.0.0 and <8.24.0 | 6.20.14, 7.30.4, 8.24.0 |
| GHSA-p62r-7637-3wwc | Laravel Hijacked authentication cookies vulnerability | medium | 0.0 | >=4.0.0 and <4.1.26 | 4.1.26 |
| GHSA-rj3w-99gc-8j58 | Laravel Risk of mass-assignment vulnerabilities | medium | 0.0 | >=4.0.0 and <4.1.29 | 4.1.29 |
| GHSA-wq8p-mqvg-2p5h | laravel framework SQL Injection via limit and offset functions | high | 0.0 | >=6.0.0 and <6.20.26 or >=7.0.0 and <7.30.5 or >=8.0.0 and <8.40.0 | 6.20.26, 7.30.5, 8.40.0 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked