{"advisories":{"laravel\/framework":[{"advisoryId":"PKSA-d5tc-s1qs-h781","packageName":"laravel\/framework","remoteId":"GHSA-jh5r-qr3c-85q8","title":"Laravel: XSS in Debug Page Information","link":"https:\/\/github.com\/advisories\/GHSA-jh5r-qr3c-85q8","cve":"CVE-2026-102279","affectedVersions":"\u003E=13.0.0,\u003C13.30.0|\u003C12.69.0","source":"GitHub","reportedAt":"2026-09-29 18:24:25","composerRepository":"https:\/\/packagist.org","severity":"low","sources":[{"name":"GitHub","remoteId":"GHSA-jh5r-qr3c-85q8"}]},{"advisoryId":"PKSA-m5cs-t1y6-qpcs","packageName":"laravel\/framework","remoteId":"GHSA-crmm-hgp2-wgrp","title":"Laravel Framework: Temporary Signed URL Path Confusion","link":"https:\/\/github.com\/advisories\/GHSA-crmm-hgp2-wgrp","cve":null,"affectedVersions":"\u003C12.61.1|\u003E=13.0.0,\u003C13.12.0","source":"GitHub","reportedAt":"2026-06-17 13:54:13","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-crmm-hgp2-wgrp"}]},{"advisoryId":"PKSA-3r5d-mb8f-1qw9","packageName":"laravel\/framework","remoteId":"GHSA-5vg9-5847-vvmq","title":"Laravel Framework: CRLF injection in default email rule ","link":"https:\/\/github.com\/advisories\/GHSA-5vg9-5847-vvmq","cve":null,"affectedVersions":"\u003C12.60.0|\u003E=13.0.0,\u003C=13.9.0","source":"GitHub","reportedAt":"2026-06-17 13:53:44","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-5vg9-5847-vvmq"}]},{"advisoryId":"PKSA-mdq4-51ck-6kdq","packageName":"laravel\/framework","remoteId":"laravel\/framework\/CVE-2026-48019.yaml","title":"Laravel CRLF injection in default email rule","link":"https:\/\/github.com\/laravel\/framework\/security\/advisories\/GHSA-5vg9-5847-vvmq","cve":"CVE-2026-48019","affectedVersions":"\u003E=9.0.0,\u003C10.0.0|\u003E=10.0.0,\u003C11.0.0|\u003E=11.0.0,\u003C12.0.0|\u003E=12.0.0,\u003C12.60.0|\u003E=13.0.0,\u003C13.10.0","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-05-19 18:13:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"laravel\/framework\/CVE-2026-48019.yaml"}]},{"advisoryId":"PKSA-8qx3-n5y5-vvnd","packageName":"laravel\/framework","remoteId":"GHSA-78fx-h6xr-vch4","title":"Laravel has a File Validation Bypass","link":"https:\/\/github.com\/advisories\/GHSA-78fx-h6xr-vch4","cve":"CVE-2025-27515","affectedVersions":"\u003C10.48.29|\u003E=11.0.0,\u003C11.44.1|\u003E=12.0.0,\u003C12.1.1","source":"GitHub","reportedAt":"2025-03-05 19:09:39","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-78fx-h6xr-vch4"}]},{"advisoryId":"PKSA-q46n-4fdk-zjr4","packageName":"laravel\/framework","remoteId":"laravel\/framework\/CVE-2024-13919.yaml","title":"Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page","link":"https:\/\/github.com\/sbaresearch\/advisories\/tree\/public\/2024\/SBA-ADV-20241209-02_Laravel_Reflected_XSS_via_Route_Parameter_in_Debug-Mode_Error_Page","cve":"CVE-2024-13919","affectedVersions":"\u003E=11.9.0,\u003C11.36.0","source":"FriendsOfPHP\/security-advisories","reportedAt":"2024-12-13 15:51:00","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-83wp-f5c3-hqqr"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"laravel\/framework\/CVE-2024-13919.yaml"}]},{"advisoryId":"PKSA-qzrn-rnz3-85w1","packageName":"laravel\/framework","remoteId":"laravel\/framework\/CVE-2024-13918.yaml","title":"Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page","link":"https:\/\/github.com\/sbaresearch\/advisories\/tree\/public\/2024\/SBA-ADV-20241209-01_Laravel_Reflected_XSS_via_Request_Parameter_in_Debug-Mode_Error_Page","cve":"CVE-2024-13918","affectedVersions":"\u003E=11.9.0,\u003C11.36.0","source":"FriendsOfPHP\/security-advisories","reportedAt":"2024-12-13 15:51:00","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-546h-56qp-8jmw"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"laravel\/framework\/CVE-2024-13918.yaml"}]},{"advisoryId":"PKSA-w7xr-vk7n-rstm","packageName":"laravel\/framework","remoteId":"laravel\/framework\/CVE-2024-52301.yaml","title":"Laravel environment manipulation via query string","link":"https:\/\/github.com\/advisories\/GHSA-gv7v-rgg6-548h","cve":"CVE-2024-52301","affectedVersions":"\u003C6.20.45|\u003E=7.0.0,\u003C7.30.7|\u003E=8.0.0,\u003C8.83.28|\u003E=9.0.0,\u003C9.52.17|\u003E=10.0.0,\u003C10.48.23|\u003E=11.0.0,\u003C11.31.0","source":"FriendsOfPHP\/security-advisories","reportedAt":"2024-11-12 15:29:00","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-gv7v-rgg6-548h"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"laravel\/framework\/CVE-2024-52301.yaml"}]},{"advisoryId":"PKSA-6wgv-k7p1-h4fg","packageName":"laravel\/framework","remoteId":"GHSA-p62r-7637-3wwc","title":"Laravel Hijacked authentication cookies vulnerability","link":"https:\/\/github.com\/advisories\/GHSA-p62r-7637-3wwc","cve":null,"affectedVersions":"\u003E=4.0.0,\u003C4.1.26","source":"GitHub","reportedAt":"2024-05-15 22:06:42","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-p62r-7637-3wwc"}]},{"advisoryId":"PKSA-11c9-dxsr-yqjb","packageName":"laravel\/framework","remoteId":"GHSA-rj3w-99gc-8j58","title":"Laravel Risk of mass-assignment vulnerabilities","link":"https:\/\/github.com\/advisories\/GHSA-rj3w-99gc-8j58","cve":null,"affectedVersions":"\u003E=4.0.0,\u003C4.1.29","source":"GitHub","reportedAt":"2024-05-15 22:05:00","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-rj3w-99gc-8j58"}]},{"advisoryId":"PKSA-dpt9-7cmv-dk65","packageName":"laravel\/framework","remoteId":"GHSA-pfg4-p438-p874","title":"Laravel Framework Deserialization Vulnerability","link":"https:\/\/github.com\/advisories\/GHSA-pfg4-p438-p874","cve":"CVE-2019-9081","affectedVersions":"\u003E=5.7.0,\u003C6.20.44","source":"GitHub","reportedAt":"2022-05-14 01:31:22","composerRepository":"https:\/\/packagist.org","severity":"critical","sources":[{"name":"GitHub","remoteId":"GHSA-pfg4-p438-p874"}]},{"advisoryId":"PKSA-3qhw-gzjt-j63j","packageName":"laravel\/framework","remoteId":"GHSA-qvqm-h22r-4cp9","title":"Laravel Framework RCE Vulnerability","link":"https:\/\/github.com\/advisories\/GHSA-qvqm-h22r-4cp9","cve":"CVE-2018-15133","affectedVersions":"\u003E=5.6.0,\u003C=5.6.29|\u003C=5.5.40","source":"GitHub","reportedAt":"2022-05-14 00:56:30","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-qvqm-h22r-4cp9"}]},{"advisoryId":"PKSA-17kp-jm2n-vxzz","packageName":"laravel\/framework","remoteId":"GHSA-w2pm-r78h-4m7v","title":"OS Command Injection in Laravel Framework","link":"https:\/\/github.com\/advisories\/GHSA-w2pm-r78h-4m7v","cve":"CVE-2020-19316","affectedVersions":"\u003C5.8.17","source":"GitHub","reportedAt":"2022-01-06 23:13:42","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-w2pm-r78h-4m7v"}]},{"advisoryId":"PKSA-p3rx-dfwp-73ny","packageName":"laravel\/framework","remoteId":"laravel\/framework\/CVE-2021-43617.yaml","title":"Image upload bypass","link":"https:\/\/github.com\/laravel\/framework\/pull\/39666","cve":"CVE-2021-43617","affectedVersions":"\u003E=8.0.0,\u003C8.71.0","source":"FriendsOfPHP\/security-advisories","reportedAt":"2021-11-18 02:10:57","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"laravel\/framework\/CVE-2021-43617.yaml"}]},{"advisoryId":"PKSA-7ywf-hktb-jkn9","packageName":"laravel\/framework","remoteId":"GHSA-w68r-5p45-5rqp","title":"Improper Input Validation in Laravel","link":"https:\/\/github.com\/advisories\/GHSA-w68r-5p45-5rqp","cve":"CVE-2020-24941","affectedVersions":"\u003E=7.0.0,\u003C7.24.0|\u003C6.18.35","source":"GitHub","reportedAt":"2021-05-06 18:54:20","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-w68r-5p45-5rqp"}]},{"advisoryId":"PKSA-ckwp-rt7t-c46m","packageName":"laravel\/framework","remoteId":"laravel\/framework\/2021-04-28.yaml","title":"SQL Server LIMIT \/ OFFSET SQL Injection","link":"https:\/\/github.com\/laravel\/framework\/security\/advisories\/GHSA-4mg9-vhxq-vm7j","cve":null,"affectedVersions":"\u003E=6.0.0,\u003C6.20.26|\u003E=7.0.0,\u003C7.30.5|\u003E=8.0.0,\u003C8.40.0","source":"FriendsOfPHP\/security-advisories","reportedAt":"2021-04-28 00:00:00","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-7852-w36x-6mf6"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"laravel\/framework\/2021-04-28.yaml"}]},{"advisoryId":"PKSA-4npr-btr6-zhny","packageName":"laravel\/framework","remoteId":"laravel\/framework\/2021-01-21.yaml","title":"Unexpected bindings in QueryBuilder","link":"https:\/\/github.com\/laravel\/framework\/security\/advisories\/GHSA-x7p5-p2c9-phvg","cve":null,"affectedVersions":"\u003E=6.0.0,\u003C6.20.14|\u003E=7.0.0,\u003C7.30.4|\u003E=8.0.0,\u003C8.24.0","source":"FriendsOfPHP\/security-advisories","reportedAt":"2021-01-21 00:00:00","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-6jvx-8ch9-j2jr"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"laravel\/framework\/2021-01-21.yaml"}]},{"advisoryId":"PKSA-njrm-6dtg-m2pc","packageName":"laravel\/framework","remoteId":"laravel\/framework\/CVE-2021-43808.yaml","title":"Possible cross-site scripting (XSS) vulnerability in the Blade templating engine","link":"https:\/\/github.com\/laravel\/framework\/security\/advisories\/GHSA-66hf-2p6w-jqfw","cve":"CVE-2021-43808","affectedVersions":"\u003C6.20.42|\u003E=7.0.0,\u003C7.30.6|\u003E=8.0.0,\u003C8.75.0","source":"FriendsOfPHP\/security-advisories","reportedAt":"2021-01-01 00:00:00","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-66hf-2p6w-jqfw"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"laravel\/framework\/CVE-2021-43808.yaml"}]},{"advisoryId":"PKSA-vhvj-tvg4-96jj","packageName":"laravel\/framework","remoteId":"laravel\/framework\/2020-08-06-1.yaml","title":"Guard bypass in Eloquent models","link":"https:\/\/blog.laravel.com\/security-release-laravel-61834-7232","cve":null,"affectedVersions":"\u003E=5.5.0,\u003C=5.5.49|\u003E=6.0.0,\u003C6.18.34|\u003E=7.0.0,\u003C7.23.2","source":"FriendsOfPHP\/security-advisories","reportedAt":"2020-08-06 00:00:00","composerRepository":"https:\/\/packagist.org","severity":"critical","sources":[{"name":"GitHub","remoteId":"GHSA-qm5c-m76r-2hfr"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"laravel\/framework\/2020-08-06-1.yaml"}]},{"advisoryId":"PKSA-nrj3-r2wg-yt8b","packageName":"laravel\/framework","remoteId":"laravel\/framework\/2020-07-27-1.yaml","title":"RCE vulnerability in \u0022cookie\u0022 session driver","link":"https:\/\/blog.laravel.com\/laravel-cookie-security-releases","cve":null,"affectedVersions":"\u003E=4.1.0,\u003C=4.1.99999|\u003E=4.2.0,\u003C=4.2.99999|\u003E=5.0.0,\u003C=5.0.99999|\u003E=5.1.0,\u003C=5.1.99999|\u003E=5.2.0,\u003C=5.2.99999|\u003E=5.3.0,\u003C=5.3.99999|\u003E=5.4.0,\u003C=5.4.99999|\u003E=5.5.0,\u003C=5.5.49|\u003E=5.6.0,\u003C=5.6.99999|\u003E=5.7.0,\u003C=5.7.99999|\u003E=5.8.0,\u003C=5.8.99999|\u003E=6.0.0,\u003C6.18.31|\u003E=7.0.0,\u003C7.22.4","source":"FriendsOfPHP\/security-advisories","reportedAt":"2020-07-27 00:00:00","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-vr95-p7q6-8m9q"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"laravel\/framework\/2020-07-27-1.yaml"}]},{"advisoryId":"PKSA-rvky-x3cg-y3qd","packageName":"laravel\/framework","remoteId":"laravel\/framework\/2020-03-13-1.yaml","title":"XSS vulnerability in blade templating","link":"https:\/\/github.com\/laravel\/framework\/pull\/31945","cve":null,"affectedVersions":"\u003E=7.0.0,\u003C7.1.2","source":"FriendsOfPHP\/security-advisories","reportedAt":"2020-03-13 00:00:00","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-44pg-c29v-hp6r"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"laravel\/framework\/2020-03-13-1.yaml"}]},{"advisoryId":"PKSA-985r-hryy-555b","packageName":"laravel\/framework","remoteId":"laravel\/framework\/CVE-2021-21263.yaml","title":"Unexpected bindings in QueryBuilder","link":"https:\/\/blog.laravel.com\/security-laravel-62011-7302-8221-released","cve":"CVE-2021-21263","affectedVersions":"\u003E=6.0.0,\u003C6.20.11|\u003E=7.0.0,\u003C7.30.2|\u003E=8.0.0,\u003C8.22.1","source":"FriendsOfPHP\/security-advisories","reportedAt":"2020-01-13 14:35:00","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-3p32-j457-pg5x"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"laravel\/framework\/CVE-2021-21263.yaml"}]},{"advisoryId":"PKSA-mhj3-vthf-h41n","packageName":"laravel\/framework","remoteId":"laravel\/framework\/2018-08-08-1.yaml","title":"Cookie serialization vulnerability","link":"https:\/\/laravel.com\/docs\/5.6\/upgrade#upgrade-5.6.30","cve":null,"affectedVersions":"\u003E=4.0.0,\u003C=4.0.11|\u003E=4.1.0,\u003C=4.1.31|\u003E=4.2.0,\u003C=4.2.22|\u003E=5.0.0,\u003C=5.0.35|\u003E=5.1.0,\u003C=5.1.46|\u003E=5.2.0,\u003C=5.2.45|\u003E=5.3.0,\u003C=5.3.31|\u003E=5.4.0,\u003C=5.4.36|\u003E=5.5.0,\u003C5.5.42|\u003E=5.6.0,\u003C5.6.30","source":"FriendsOfPHP\/security-advisories","reportedAt":"2018-08-08 00:00:00","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-jwvj-pwww-3mj5"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"laravel\/framework\/2018-08-08-1.yaml"}]},{"advisoryId":"PKSA-cn77-7mny-v9zg","packageName":"laravel\/framework","remoteId":"laravel\/framework\/2018-03-30-1.yaml","title":"Exploit of encryption failure vulnerability","link":"https:\/\/medium.com\/@taylorotwell\/laravel-security-release-5-6-15-and-5-5-40-56f1257933a0","cve":null,"affectedVersions":"\u003E=4.0.0,\u003C=4.0.11|\u003E=4.1.0,\u003C=4.1.31|\u003E=4.2.0,\u003C=4.2.22|\u003E=5.0.0,\u003C=5.0.35|\u003E=5.1.0,\u003C=5.1.46|\u003E=5.2.0,\u003C=5.2.45|\u003E=5.3.0,\u003C=5.3.31|\u003E=5.4.0,\u003C=5.4.36|\u003E=5.5.0,\u003C5.5.40|\u003E=5.6.0,\u003C5.6.15","source":"FriendsOfPHP\/security-advisories","reportedAt":"2018-03-30 00:00:00","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-4mg9-vhxq-vm7j"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"laravel\/framework\/2018-03-30-1.yaml"}]},{"advisoryId":"PKSA-xf4x-p5c1-z9xq","packageName":"laravel\/framework","remoteId":"laravel\/framework\/CVE-2017-14775.yaml","title":"Timing attack vector for remember me token","link":"https:\/\/github.com\/laravel\/framework\/pull\/21320","cve":"CVE-2017-14775","affectedVersions":"\u003E=4.1.26,\u003C=4.1.31|\u003E=4.2.0,\u003C=4.2.22|\u003E=5.0.0,\u003C=5.0.35|\u003E=5.1.0,\u003C=5.1.46|\u003E=5.2.0,\u003C=5.2.45|\u003E=5.3.0,\u003C=5.3.31|\u003E=5.4.0,\u003C=5.4.36|\u003E=5.5.0,\u003C5.5.10","source":"FriendsOfPHP\/security-advisories","reportedAt":"2017-09-21 01:38:58","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-c2v7-j5gq-wcq4"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"laravel\/framework\/CVE-2017-14775.yaml"}]},{"advisoryId":"PKSA-fwj1-r2kg-bmxd","packageName":"laravel\/framework","remoteId":"laravel\/framework\/CVE-2017-9303.yaml","title":"Password reset phishing vulnerability","link":"https:\/\/laravel.com\/docs\/5.4\/releases#laravel-5.4.22","cve":"CVE-2017-9303","affectedVersions":"\u003E=5.3.0,\u003C=5.3.31|\u003E=5.4.0,\u003C5.4.22","source":"FriendsOfPHP\/security-advisories","reportedAt":"2017-05-07 17:49:26","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-rc8x-jrrc-frfv"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"laravel\/framework\/CVE-2017-9303.yaml"}]},{"advisoryId":"PKSA-4d28-pz9s-51zj","packageName":"laravel\/framework","remoteId":"laravel\/framework\/2014-05-20.yaml","title":"Risk of mass-assignment vulnerabilities","link":"https:\/\/laravel.com\/docs\/5.3\/upgrade#upgrade-4.1.29","cve":null,"affectedVersions":"\u003E=4.0.0,\u003C4.0.99|\u003E=4.1.0,\u003C4.1.29","source":"FriendsOfPHP\/security-advisories","reportedAt":"2014-05-20 00:00:00","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-x7p5-p2c9-phvg"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"laravel\/framework\/2014-05-20.yaml"}]},{"advisoryId":"PKSA-gf52-cc16-7thv","packageName":"laravel\/framework","remoteId":"laravel\/framework\/2014-04-15.yaml","title":"Hijacked authentication cookies vulnerability","link":"https:\/\/laravel.com\/docs\/5.3\/upgrade#upgrade-4.1.26","cve":null,"affectedVersions":"\u003E=4.0.0,\u003C4.0.99|\u003E=4.1.0,\u003C4.1.26","source":"FriendsOfPHP\/security-advisories","reportedAt":"2014-04-15 00:00:00","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-wq8p-mqvg-2p5h"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"laravel\/framework\/2014-04-15.yaml"}]}]}}