Critical: Laravel has an open critical advisory
Read the advisory →Laravel stack security advisories
The tools a typical Laravel app runs on, in one list: PHP, Laravel, Livewire, Symfony components, Doctrine, Guzzle and Composer.
11 advisories affect supported versions.
Tools in the stack
Each has its own page, with its supported branches and a check for your version.
| Tool | Latest release | Status |
|---|---|---|
| PHP php | 8.5.12 | 2 open |
| Laravel laravel/framework | 13.42.0 | 2 open |
| Livewire livewire/livewire | 4.4.8 | No advisories |
| Symfony components symfony/http-kernel | 8.1.11 | 7 open |
| Doctrine doctrine/orm | 3.7.6 | No advisories |
| Guzzle guzzlehttp/guzzle | 8.3.1 | No open advisories |
| Composer composer/composer | 2.11.2 | No open advisories |
Advisories across the stack
179 advisories, newest first.
-
high CVE-2026-118514 Reviewed
Symfony Security: HEAD Requests Skip access_control Rules Limited to GET
Lets HEAD requests reach pages that access_control rules or firewalls protect only for GET, running the controller without the check.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56 -
high CVE-2026-118516 Reviewed
Symfony Routing: Host Placeholders Can Bypass Path-Based Access Rules
Lets requests reach controllers that path-based access_control rules protect, in apps with routes that use host placeholders.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56 -
low Reviewed
Symfony HttpFoundation: Paths Glued to index.php Bypass Web Server Path Rules
Lets requests get past nginx, Apache, CDN or WAF rules on a path like /admin, while Symfony still routes them to that path.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56 -
medium Reviewed
Symfony: private_ranges Trusted Proxies Setting Trusts Some Remote Clients
Lets some IPv6 clients pass as trusted proxies and set X-Forwarded headers in apps that use trusted_proxies: private_ranges.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 -
medium Reviewed
Symfony HttpFoundation: Crafted Links Make Generated URLs Point Elsewhere
Lets a crafted link make an app's links, forms and redirects point to another host, when its front controller sits in a subdirectory.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56 -
low CVE-2026-123339 Reviewed
Symfony HttpKernel: Inline Fragments Let Forwarded Headers Change URLs
Lets client headers set the host of absolute URLs after an inline fragment renders, in apps reached from 127.0.0.1 without it as a trusted proxy.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56+ 2 older releases
-
medium CVE-2026-45070 Reviewed
Symfony Mime: Header Injection Through Mime Parameter Names
Lets an attacker add extra email headers in apps that build a Content-Type or Content-Disposition parameter name from user input.
Update Symfony to
8.1.x 8.1.10 7.4.x 7.4.22 6.4.x 6.4.49 5.4.x 5.4.55 -
critical CVE-2026-114509 Reviewed
Laravel TokenGuard: Log In as Any User Without Their API Token
Lets an unauthenticated attacker log in as another user in Laravel apps that use the token auth guard with MySQL or MariaDB.
Update Laravel to
13.x 13.27.0 12.x 12.68.0+ 2 older releases
-
medium CVE-2026-114508 Reviewed
Laravel: Relationship Includes on Read Endpoints Can Destroy Data
Lets a user with only read access trigger a destructive query, such as emptying a related table, through relationship includes in some Laravel apps.
Update Laravel to
13.x 13.27.0 12.x 12.68.0 -
critical CVE-2026-109618
RCE via OOM corruption
Update PHP to
8.5.x 8.5.12 8.4.x 8.4.27 8.3.x 8.3.36 8.2.x 8.2.35 -
critical CVE-2026-109619
RCE via stale global state
Update PHP to
8.5.x 8.5.12 8.4.x 8.4.27 8.3.x 8.3.36 8.2.x 8.2.35 -
medium CVE-2026-59944 Reviewed
Composer: Malicious Package Can Change File Permissions Outside Vendor
Lets a malicious dependency make a file outside its own folder readable and runnable by anyone, getting around the earlier GHSA-gjfg-22fp-rrxx fix.
Update Composer to
2.10.x 2.10.3+ 1 older release
-
low CVE-2026-102279 Reviewed
Laravel Debug Page: Cross-Site Scripting When APP_DEBUG Is On
Lets an attacker run script in a visitor's browser through the Laravel debug error page, when APP_DEBUG=true and the visitor hovers a tooltip.
Update Laravel to
13.x 13.30.0 12.x 12.69.0 -
medium CVE-2026-93682
Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
medium CVE-2026-92842
OOB read / info leak in convert.* stream filters when line-break-chars contains NUL
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
Update PHP to
8.5.x 8.5.10 8.4.x 8.4.25 8.3.x 8.3.35 8.2.x 8.2.34 -
medium CVE-2026-91768
IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
medium CVE-2026-91769
TLS Hostname Verification Falls Back to CN After SAN Mismatch
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
medium CVE-2026-91767
Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
low CVE-2025-1218
Various packet overreads in mysqlnd_writeprotocol.c
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
medium CVE-2026-91766
Cross-origin credential leak in HTTP stream wrapper redirects
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
high CVE-2026-91765
SOAP: Unbounded Recursion in Server-Side cleanup_xml_node
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
medium CVE-2025-14181
Integer overflow to buffer overflow in soap HTTP parsing
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
medium CVE-2026-6103
Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
medium CVE-2026-17545
PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
high CVE-2026-108082 Reviewed
Symfony HttpFoundation: Crafted Cache-Control Header Ties Up the CPU
Lets an unauthenticated attacker burn close to a second of CPU per request with a crafted Cache-Control header, in any app built on HttpFoundation.
Update Symfony to
8.1.x 8.1.7 7.4.x 7.4.19 6.4.x 6.4.46 5.4.x 5.4.54 -
high CVE-2026-84361 Reviewed
Composer: Malicious Package Can Run Commands via a Perforce Source URL
Lets a malicious package run commands during composer install on machines with the p4 client, when it comes from a repository other than Packagist.org.
Update Composer to
2.10.x 2.10.3+ 1 older release
-
high CVE-2026-69246 Reviewed
Guzzle: Oddly Written Hosts Can Slip Past Host-Based Checks
Lets an attacker reach hosts an app meant to block, such as loopback, when the app builds Guzzle request URLs from user input and checks the host first.
Update Guzzle to
8.0.x 8.0.1 7.15.x 7.15.2 -
medium CVE-2026-69245 Reviewed
Guzzle: Cookies for Numeric or Escaped Domains Leak to Other Hosts
Can leak cookies set for an IP-style Domain to other hosts in apps that use Guzzle's cookie jar, exposing session ids or tokens.
Update Guzzle to
8.0.x 8.0.1 7.15.x 7.15.2 -
medium CVE-2026-7260
Stack overflow in phar with circular symlinks
Update PHP to
8.5.x 8.5.9 8.4.x 8.4.24 8.3.x 8.3.33 8.2.x 8.2.33 -
high CVE-2026-17544
Out-of-bounds write in bccomp() via crafted operand and scale
Update PHP to
8.5.x 8.5.9 8.4.x 8.4.24 -
high CVE-2026-17543
SQL injection in ext-pgsql via E'...' backslash breakout
Update PHP to
8.5.x 8.5.9 8.4.x 8.4.24 8.3.x 8.3.33 8.2.x 8.2.33 -
medium CVE-2026-59882 Reviewed
guzzlehttp/psr7: Malformed URI Hosts Can Fool Host Checks
Lets an attacker get past host allowlists or SSRF checks in apps that build a psr7 Uri from user input and trust getHost().
Update Guzzle to
2.12.x 2.12.3 -
medium CVE-2026-67354 Reviewed
Guzzle: Redirects Can Leak URL Fragments in the Referer Header
Can leak secrets kept in a URL fragment to a redirect target, in apps that turn on Guzzle's referer redirect option.
Update Guzzle to
7.15.x 7.15.1 -
medium CVE-2026-67355 Reviewed
Guzzle: Host-Only Cookies Are Sent to Subdomains
Can send a parent host's session cookies to its subdomains in apps that reuse one Guzzle cookie jar across hosts.
Update Guzzle to
7.15.x 7.15.1 -
medium CVE-2026-67353 Reviewed
Guzzle: Malicious Server Can Flood the Cookie Jar
Lets a malicious server fill Guzzle's cookie jar with large cookies, using memory and breaking later requests that share the jar.
Update Guzzle to
7.15.x 7.15.1 -
medium CVE-2026-59883 Reviewed
Guzzle: Cookies Set for IP Addresses Leak to Look-Alike Hosts
Can send cookies scoped to an IP address to other hosts, or let those hosts plant cookies, in apps that use Guzzle's cookie jar.
Update Guzzle to
7.12.x 7.12.3 -
medium CVE-2026-59946 Reviewed
Composer: Malicious Package Can Make Private Files World-Readable
Lets a malicious dependency change permissions on files outside its folder, making private files such as SSH keys readable by other users.
Update Composer to
2.10.x 2.10.2+ 1 older release
-
medium CVE-2026-59947 Reviewed
Composer: Tokens in Repository URLs Leak Into -vvv Debug Logs
Exposes access tokens placed in the username part of a repository URL to anyone who can read Composer's -vvv debug output.
Update Composer to
2.10.x 2.10.2+ 1 older release
-
medium CVE-2026-67339 Reviewed
Guzzle: Proxy Credentials Can Be Sent to the Destination Server
Can send Proxy-Authorization credentials to the target server when a request skips the HTTP proxy, with Guzzle's cURL handlers.
Update Guzzle to
7.14.x 7.14.2 -
high CVE-2026-59948 Reviewed
Composer: Malicious Package Name Can Write Files Outside Vendor
Lets a malicious package from a third-party repository write files anywhere the Composer user can, which can lead to running code.
Update Composer to
2.10.x 2.10.2+ 1 older release
-
high CVE-2026-12184
Failure to setup TLS with a remote server can result in a remote DoS
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.32 -
medium CVE-2026-14355
ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD
Update PHP to
8.5.x 8.5.8 8.4.x 8.4.23 8.3.x 8.3.32 8.2.x 8.2.32 -
medium CVE-2026-55767 Reviewed
Guzzle: Cookies With a Dot-Only Domain Are Sent to Every Host
Lets a malicious server plant a cookie that Guzzle then sends to every other host using the same cookie jar.
Update Guzzle to
7.12.x 7.12.1 -
medium CVE-2026-55568 Reviewed
Guzzle: HTTPS Proxy Silently Falls Back to Cleartext on Old libcurl
Can send proxy traffic unencrypted when Guzzle is set to use an https:// proxy and the server's libcurl is older than 7.50.2.
Update Guzzle to
7.12.x 7.12.1 -
medium CVE-2026-55766 Reviewed
guzzlehttp/psr7: Header Injection Through the Method or Reason Phrase
Lets an attacker inject HTTP headers when an app puts user input in a psr7 method, protocol or reason phrase and serializes the message.
Update Guzzle to
2.12.x 2.12.1 -
medium Reviewed
Laravel Local Disk: Expired Temporary URLs Can Stay Valid
Can let expired temporary signed URLs keep working, or point to a different file, in Laravel apps that serve the local disk with temporary URLs.
Update Laravel to
13.x 13.12.0 12.x 12.61.1 -
high Reviewed
Laravel Email Rule: Header Injection Into Outgoing Mail
Lets an unauthenticated attacker interfere with outgoing email in Laravel apps that send mail to addresses users supply.
Update Laravel to
12.x 12.60.0 -
medium CVE-2026-53723 Reviewed
Guzzle Services: XML Injection in Outgoing Request Bodies
Lets user input add XML markup to request bodies in apps that use guzzle-services to send XML built from that input.
Update Guzzle to
1.5.x 1.5.4 -
medium CVE-2026-48736 Reviewed
Symfony HttpClient: IPv6 Transition Addresses Bypass Private Network Block
Lets an attacker reach private network hosts through NoPrivateNetworkHttpClient by using IPv6 addresses that wrap a private IPv4 address.
Update Symfony to
7.4.x 7.4.13 6.4.x 6.4.41 5.4.x 5.4.53+ 1 older release
-
medium CVE-2026-48784 Reviewed
Symfony Routing: Chained ../ in Parameters Escape Generated URLs
Can make URLs built by UrlGenerator point to a different path than intended when a route parameter holds a chain of ../ or ./ segments.
Update Symfony to
7.4.x 7.4.13 6.4.x 6.4.41 5.4.x 5.4.53+ 1 older release
-
low CVE-2026-46644 Reviewed
Symfony Polyfill IDN: Invalid xn-- Labels Treated as Normal Domains
Can let two different domain names compare as equal, getting past domain blocklists, on PHP installs without the intl extension.
Only affects branches that no longer get security fixes
-
medium CVE-2026-49214 Reviewed
guzzlehttp/psr7: Header Injection Through the URI Host
Lets an attacker inject HTTP headers when an app builds a psr7 request from a user URL and serializes it as raw HTTP.
Update Guzzle to
2.10.x 2.10.2 -
medium CVE-2026-48998 Reviewed
guzzlehttp/psr7: Crafted Host Header Changes the Request's Host
Lets an attacker make an incoming request's URI host differ from its Host header in apps that build server requests with guzzlehttp/psr7.
Update Guzzle to
2.10.x 2.10.2 -
medium CVE-2026-45068 Reviewed
Symfony Mailer: Recipient Addresses Can Become Sendmail Options
Lets a recipient address starting with a dash pass options to sendmail, in apps using SendmailTransport in -t mode.
Update Symfony to
7.4.x 7.4.12 6.4.x 6.4.40 5.4.x 5.4.52+ 1 older release
-
medium CVE-2026-45065 Reviewed
Symfony Routing: Loose Route Requirements Let Links Point Off-Site
Lets a crafted parameter value pass a route requirement written as a list of options, so path() or url() builds a link to another host.
Update Symfony to
7.4.x 7.4.12 6.4.x 6.4.40 5.4.x 5.4.52+ 1 older release
-
high CVE-2026-45067 Reviewed
Symfony Mime: Line Breaks in Addresses Allow Email Header Injection
Lets an attacker add email headers or SMTP commands through a crafted address in apps that pass user addresses to Symfony Mailer.
Update Symfony to
7.4.x 7.4.12 6.4.x 6.4.40 5.4.x 5.4.52+ 1 older release
-
high CVE-2026-45075 Reviewed
Symfony Security: HEAD Requests Skip Checks Limited to GET
Lets HEAD requests skip #[IsGranted], #[IsSignatureValid] and #[IsCsrfTokenValid] checks that set methods: ['GET'].
Update Symfony to
7.4.x 7.4.12+ 1 older release
-
high CVE-2026-48019 Reviewed
Laravel Email Rule: Header Injection Into Outgoing Mail
Lets an unauthenticated attacker interfere with outgoing email in Laravel apps that send mail to addresses users supply.
Update Laravel to
13.x 13.10.0 12.x 12.60.0 -
high CVE-2026-45793 Reviewed
Composer: GitHub Tokens With Hyphens Printed in Full to CI Logs
Exposes GitHub Actions GITHUB_TOKEN values, and other GitHub tokens containing a hyphen, in Composer's error output and CI logs.
Update Composer to
2.9.x 2.9.8 1.10.x 1.10.28+ 1 older release
-
medium CVE-2026-7262
NULL pointer dereference in SOAP apache:Map decoder with missing <value>
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31 -
medium CVE-2026-7261
SoapServer session-persisted object use-after-free via SOAP header fault
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31 -
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31 -
medium CVE-2026-6735
XSS within PHP-FPM status endpoint
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31 -
high CVE-2026-6722
Use-After-Free in SOAP using Apache map with Remote Code Execution
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31 -
medium CVE-2026-7258
Out-of-bounds read in urldecode()
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31 -
medium CVE-2026-6104
Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 -
high CVE-2025-14179
SQL injection in pdo_firebird via NUL bytes in quoted strings
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31 -
low CVE-2026-7568
Signed integer overflow in metaphone()
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31 -
high CVE-2026-7263
DoS attack via DOMNode::C14N()
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 -
high CVE-2026-40261 Reviewed
Composer: Malicious Perforce Package Metadata Can Run Commands on Install
Lets a malicious or compromised package repository run commands when Composer installs packages from source, even without Perforce installed.
Update Composer to
2.9.x 2.9.6+ 1 older release
-
high CVE-2026-40176 Reviewed
Composer: Perforce Settings in an Untrusted composer.json Can Run Commands
Lets a malicious project's composer.json run commands on your machine when you run Composer in it, even without Perforce installed.
Update Composer to
2.9.x 2.9.6+ 1 older release
-
high CVE-2026-39976 Reviewed
Laravel Passport: Client Credentials Tokens Can Authenticate as a Real User
Can let a machine-to-machine token act as the user whose ID matches the client's ID, such as when Passport::$clientUuids is false.
Update Passport to
13.x 13.7.1 -
medium CVE-2026-24739 Reviewed
Symfony Process on Windows: Git Bash Can Mangle Arguments and Hit Wrong Paths
Can make file commands run through Symfony Process act on the wrong path, up to deleting a whole directory, when PHP runs from Git Bash.
Update Symfony to
7.4.x 7.4.5 6.4.x 6.4.33 5.4.x 5.4.51+ 2 older releases
-
critical CVE-2026-23524 Reviewed
Laravel Reverb: Remote Code Execution Through Redis When Scaling Is Enabled
Allows remote code execution in Reverb apps with REVERB_SCALING_ENABLED=true by anyone who can publish to the Redis server Reverb uses.
Update Reverb to
1.7.x 1.7.0 -
low CVE-2025-67746 Reviewed
Composer: Remote Sources Can Inject Terminal Control Codes Into Output
Lets a source Composer downloads from inject ANSI control characters that garble Composer's terminal output.
Update Composer to
2.9.x 2.9.3+ 1 older release
-
Update PHP to
8.5.x 8.5.1 8.4.x 8.4.16 8.3.x 8.3.29 8.2.x 8.2.30+ 1 older release
-
medium CVE-2025-14180
NULL Pointer Dereference in PDO quoting
Update PHP to
8.5.x 8.5.1 8.4.x 8.4.16 8.3.x 8.3.29 8.2.x 8.2.30+ 1 older release
-
medium CVE-2025-14178
Heap buffer overflow in array_merge()
Update PHP to
8.5.x 8.5.1 8.4.x 8.4.16 8.3.x 8.3.29 8.2.x 8.2.30+ 1 older release
-
medium CVE-2025-14177
Information Leak of Memory in getimagesize
Update PHP to
8.5.x 8.5.1 8.4.x 8.4.16 8.3.x 8.3.29 8.2.x 8.2.30+ 1 older release
-
high CVE-2025-64500 Reviewed
Symfony HttpFoundation: Malformed Paths Can Slip Past Access Rules
Lets an attacker reach some URLs that path-based access rules should block, in apps whose rules assume every path starts with a slash.
Update Symfony to
6.4.x 6.4.29 5.4.x 5.4.50+ 1 older release
-
medium CVE-2025-1735
pgsql extension does not check for errors during escaping
Update PHP to
8.4.x 8.4.10 8.3.x 8.3.23 8.2.x 8.2.29+ 1 older release
-
medium CVE-2025-6491
NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
Update PHP to
8.4.x 8.4.10 8.3.x 8.3.23 8.2.x 8.2.29+ 1 older release
-
low CVE-2025-1220
Null byte termination in hostnames
Update PHP to
8.4.x 8.4.10 8.3.x 8.3.23 8.2.x 8.2.29+ 1 older release
-
medium CVE-2024-11235
Reference counting in php_request_shutdown causes Use-After-Free
Update PHP to
8.4.x 8.4.5 8.3.x 8.3.19 -
Update PHP to
8.4.x 8.4.5 8.3.x 8.3.19 8.2.x 8.2.28+ 1 older release
-
medium CVE-2025-1219
libxml streams use wrong `content-type` header when requesting a redirected resource
Update PHP to
8.4.x 8.4.5 8.3.x 8.3.19 8.2.x 8.2.28+ 1 older release
-
medium CVE-2025-1736
Stream HTTP wrapper header check might omit basic auth header
Update PHP to
8.4.x 8.4.5 8.3.x 8.3.19 8.2.x 8.2.28+ 1 older release
-
medium CVE-2025-1861
Stream HTTP wrapper truncate redirect location to 1024 bytes
Update PHP to
8.4.x 8.4.5 8.3.x 8.3.19 8.2.x 8.2.28+ 1 older release
-
medium CVE-2025-1734
Streams HTTP wrapper does not fail for headers with invalid name and no colon
Update PHP to
8.4.x 8.4.5 8.3.x 8.3.19 8.2.x 8.2.28+ 1 older release
-
medium CVE-2025-1217
Header parser of `http` stream wrapper does not handle folded headers
Update PHP to
8.4.x 8.4.5 8.3.x 8.3.19 8.2.x 8.2.28+ 1 older release
-
medium CVE-2025-27515 Reviewed
Laravel Validation: Crafted Requests Can Bypass files.* Wildcard Rules
Lets an attacker get files past validation in Laravel apps that validate arrays of files or images with wildcard rules like files.*.
Update Laravel to
12.x 12.1.1+ 2 older releases
-
medium CVE-2025-21617 Reviewed
Guzzle OAuth Subscriber: Weak Nonces Can Allow Replayed OAuth 1 Requests
Generates weak OAuth 1 nonces, which can leave the servers your app calls open to replayed requests when the connection doesn't use TLS.
Update Guzzle to
0.8.x 0.8.1 -
high CVE-2024-55661 Reviewed
Laravel Pulse: Dashboard Users Can Run Code on the Server
Lets a user who can open the Pulse dashboard call functions and static methods in the app, which can lead to running code on the server.
Update Pulse to
1.3.x 1.3.1 -
medium CVE-2024-13919 Reviewed
Laravel Debug Error Page: Route Parameters Can Run Injected JavaScript
Lets a crafted link run JavaScript in a visitor's browser on Laravel 11 apps that show the debug error page with APP_DEBUG=true.
Only affects branches that no longer get security fixes
-
medium CVE-2024-13918 Reviewed
Laravel Debug Error Page: Request Parameters Allow Reflected XSS
Lets an attacker run script in a visitor's browser through a crafted link to a Laravel app running with APP_DEBUG=true.
Only affects branches that no longer get security fixes
-
high CVE-2024-8929
[Mysqlnd] Leak partial content of the heap through heap buffer over-read
Update PHP to
8.3.x 8.3.14 8.2.x 8.2.26+ 1 older release
-
medium CVE-2024-8932
OOB access in ldap_escape
Update PHP to
8.3.x 8.3.14 8.2.x 8.2.26+ 1 older release
-
medium CVE-2024-11234
Configuring a proxy in a stream context might allow for CRLF injection in URIs
Update PHP to
8.3.x 8.3.14 8.2.x 8.2.26+ 1 older release
-
medium CVE-2024-11236
Integer overflow in the firebird and dblib quoters causing OOB writes
Update PHP to
8.3.x 8.3.14 8.2.x 8.2.26+ 1 older release
-
medium CVE-2024-11233
Single byte overread with convert.quoted-printable-decode filter
Update PHP to
8.3.x 8.3.14 8.2.x 8.2.26+ 1 older release
-
Update PHP to
8.3.x 8.3.14 8.2.x 8.2.26+ 1 older release
-
high CVE-2024-52301 Reviewed
Laravel Environment Detection: Query Strings Can Switch the App Environment
Lets anyone change the environment Laravel uses for a request through the URL's query string, on servers where PHP's register_argc_argv is On.
Only affects branches that no longer get security fixes
-
low CVE-2024-50345 Reviewed
Symfony HttpFoundation: Malformed URLs Can Slip Past Redirect Checks
Lets an attacker send users to another domain when an app checks redirect targets with the Request class, which parsed some URLs unlike browsers.
Update Symfony to
6.4.x 6.4.14 5.4.x 5.4.46+ 1 older release
-
high CVE-2024-51736 Reviewed
Symfony Process on Windows: A cmd.exe in the Working Directory Gets Run
Lets a cmd.exe file in the current working directory run instead of the real one when Symfony's Process class runs commands on Windows.
Update Symfony to
6.4.x 6.4.14 5.4.x 5.4.46+ 1 older release
-
high CVE-2024-50347 Reviewed
Laravel Reverb: Pusher API Requests Accepted Without Signature Checks
Lets anyone who knows the app ID send events or read channel data through Reverb's Pusher-compatible HTTP API without a valid signature.
Update Reverb to
1.4.x 1.4.0 -
high CVE-2024-4577
PHP RCE: A Bypass of CVE-2012-1823, Argument Injection in PHP-CGI
Update PHP to
8.3.x 8.3.8 8.2.x 8.2.20+ 1 older release
-
medium CVE-2024-8927
cgi.force_redirect configuration is bypassable due to the environment variable collision
Update PHP to
8.3.x 8.3.12 8.2.x 8.2.24+ 1 older release
-
medium CVE-2024-8926
PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)
Update PHP to
8.3.x 8.3.12 8.2.x 8.2.24+ 1 older release
-
low CVE-2024-8925
Erroneous parsing of multipart form data
Update PHP to
8.3.x 8.3.12 8.2.x 8.2.24+ 1 older release
-
low CVE-2024-9026
[PHP-FPM] Logs from childrens may be altered
Update PHP to
8.3.x 8.3.12 8.2.x 8.2.24+ 1 older release
-
high CVE-2024-35241 Reviewed
Composer: Malicious Git Branch Names Can Run Code on status or remove
Lets a malicious package repository run commands on your machine when you run composer status, reinstall or remove on source installs.
Update Composer to
2.7.x 2.7.7+ 1 older release
-
high CVE-2024-35242 Reviewed
Composer: Malicious Git or Hg Branch Names Can Run Code on composer install
Lets an untrusted repository run commands on your machine when you clone it and run composer install inside it.
Update Composer to
2.7.x 2.7.7+ 1 older release
-
high CVE-2024-5585
bypass CVE-2024-1874
Update PHP to
8.3.x 8.3.8 8.2.x 8.2.20+ 1 older release
-
medium CVE-2024-5458
Filter bypass in filter_var (FILTER_VALIDATE_URL)
Update PHP to
8.3.x 8.3.8 8.2.x 8.2.20+ 1 older release
-
medium Reviewed
Laravel 4 Remember-Me Cookies Stay Valid After the User Logs Out
Lets someone with a stolen remember-me cookie keep logging in as that user, even after the user logs out or resets their password.
Only affects branches that no longer get security fixes
-
medium Reviewed
Laravel 4 Eloquent: Models Using $guarded Open to Mass Assignment
Can let users set model columns you meant to protect in Laravel 4 apps that use $guarded and pass request input to update or save.
Only affects branches that no longer get security fixes
-
high CVE-2024-2757
mb_encode_mimeheader runs endlessly for some inputs
Update PHP to
8.3.x 8.3.6 -
low CVE-2024-3096
password_verify can erroneously return true, opening ATO risk
Update PHP to
8.3.x 8.3.6 8.2.x 8.2.18+ 1 older release
-
critical CVE-2024-1874
Command injection via array-ish $command parameter of proc_open even if bypass_shell option enabled on Windows
Update PHP to
8.3.x 8.3.6 8.2.x 8.2.18+ 1 older release
-
medium CVE-2024-2756
__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix
Update PHP to
8.3.x 8.3.6 8.2.x 8.2.18+ 1 older release
-
high CVE-2024-24821 Reviewed
Composer: Tampered vendor/composer Files Run Code When Composer Runs
Lets code planted in a project's vendor/composer files run as whoever runs Composer there, including root when Composer runs with sudo.
Update Composer to
2.7.x 2.7.0+ 1 older release
-
high CVE-2023-43655 Reviewed
Composer: A Web-Accessible composer.phar Can Let Attackers Run Code
Lets an attacker run code on a server that publishes composer.phar where PHP executes it and register_argc_argv is enabled.
Update Composer to
2.6.x 2.6.4 1.10.x 1.10.27+ 1 older release
-
low CVE-2023-3247
Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP
Update PHP to
8.2.x 8.2.7+ 1 older release
-
medium CVE-2023-29197 Reviewed
Guzzle PSR-7: Newlines Allowed in Header Names and Values
Allows header injection when untrusted input containing a newline ends up in header names or values built with guzzlehttp/psr7.
Update Guzzle to
2.4.x 2.4.5 1.9.x 1.9.1 -
low CVE-2023-0567
BCrypt hashes erroneously validate if the salt is cut short by `$`
Update PHP to
8.2.x 8.2.3+ 1 older release
-
high CVE-2023-0662
DoS vulnerability when parsing multipart request body
Update PHP to
8.2.x 8.2.3+ 1 older release
-
medium CVE-2022-24894 Reviewed
Symfony HttpCache: Session Cookies Can Be Cached and Served to Others
Can leak one user's session cookie to other visitors in apps that run Symfony's HttpCache reverse proxy.
Update Symfony to
5.4.x 5.4.20+ 4 older releases
-
high CVE-2022-31091
Change in port should be considered a change in origin
Update Guzzle to
7.4.x 7.4.5 6.5.x 6.5.8 -
high CVE-2022-31090
CURLOPT_HTTPAUTH option not cleared on change of origin
Update Guzzle to
7.4.x 7.4.5 6.5.x 6.5.8 -
high CVE-2022-31043
Fix failure to strip Authorization header on HTTP downgrade
Update Guzzle to
7.4.x 7.4.4 6.5.x 6.5.7 -
high CVE-2022-31042
Failure to strip the Cookie header on change in host or HTTP downgrade
Update Guzzle to
7.4.x 7.4.4 6.5.x 6.5.7 -
high CVE-2022-29248
Cross-domain cookie leakage
Update Guzzle to
7.4.x 7.4.3 6.5.x 6.5.6 -
critical CVE-2019-9081
Laravel Framework Deserialization Vulnerability
Only affects branches that no longer get security fixes
-
high CVE-2018-15133
Laravel Framework RCE Vulnerability
No fixed release listed yet
-
high CVE-2022-24828
Missing input validation can lead to command execution in composer
Update Composer to
2.3.x 2.3.5 1.10.x 1.10.26+ 1 older release
-
medium CVE-2022-24775
Inproper parsing of HTTP headers
Update Guzzle to
2.1.x 2.1.1 1.8.x 1.8.4 -
high CVE-2022-25838
Multi-Factor Authentication issue in Laravel Fortify
Update Fortify to
1.11.x 1.11.1 -
high CVE-2020-19316
OS Command Injection in Laravel Framework
Only affects branches that no longer get security fixes
-
critical CVE-2021-43617 Reviewed
Laravel Validation: Upload Rules Don't Block .phar Files
Can let uploaded .phar files run as PHP on Debian-based servers, because Laravel's upload validation didn't block the .phar extension.
Only affects branches that no longer get security fixes
-
medium CVE-2021-41267
CVE-2021-41267: Webcache Poisoning via X-Forwarded-Prefix and sub-request
Only affects branches that no longer get security fixes
-
high CVE-2021-41116
Improper escaping of command arguments on Windows leading to command injection
Update Composer to
2.1.x 2.1.9 1.10.x 1.10.23 -
high CVE-2020-24941
Improper Input Validation in Laravel
Only affects branches that no longer get security fixes
-
Only affects branches that no longer get security fixes
-
high CVE-2021-29472
Missing argument delimiter can lead to command execution via VCS repository URLs or source download URLs on systems with Mercurial
Update Composer to
2.0.x 2.0.13 1.10.x 1.10.22 -
Only affects branches that no longer get security fixes
-
medium CVE-2021-43808
Possible cross-site scripting (XSS) vulnerability in the Blade templating engine
Only affects branches that no longer get security fixes
-
high CVE-2020-15094
CVE-2020-15094: Prevent RCE when calling untrusted remote with CachingHttpClient
Only affects branches that no longer get security fixes
-
critical CVE-2020-24940
Guard bypass in Eloquent models
Only affects branches that no longer get security fixes
-
Only affects branches that no longer get security fixes
-
Only affects branches that no longer get security fixes
-
medium CVE-2020-5274
CVE-2020-5274: Fix Exception message escaping rendered by ErrorHandler
Only affects branches that no longer get security fixes
-
Only affects branches that no longer get security fixes
-
high CVE-2021-21263
Unexpected bindings in QueryBuilder
Only affects branches that no longer get security fixes
-
high CVE-2019-18888
CVE-2019-18888: Prevent argument injection in a MimeTypeGuesser
Only affects branches that no longer get security fixes
-
high CVE-2019-18887
CVE-2019-18887: Use constant time comparison in UriSigner
Only affects branches that no longer get security fixes
-
critical CVE-2019-10913
CVE-2019-10913: Reject invalid HTTP method overrides
Only affects branches that no longer get security fixes
-
Only affects branches that no longer get security fixes
-
medium CVE-2018-14773
CVE-2018-14773: Remove support for legacy and risky HTTP headers
Only affects branches that no longer get security fixes
-
medium CVE-2018-11386
CVE-2018-11386: Denial of service when using PDOSessionHandler
Only affects branches that no longer get security fixes
-
Only affects branches that no longer get security fixes
-
medium CVE-2017-14775
Timing attack vector for remember me token
Only affects branches that no longer get security fixes
-
medium CVE-2017-9303
Password reset phishing vulnerability
Only affects branches that no longer get security fixes
-
high CVE-2016-5385
HTTP Proxy header vulnerability
Update Guzzle to
8.1.x 8.1.7 6.2.x 6.2.1 5.3.x 5.3.1+ 1 older release
-
high CVE-2015-8371
Composer Cache Injection vulnerability
Update Composer to
1.0.x 1.0.0-beta1 -
medium
State guessing vulnerability
Update Socialite to
2.0.x 2.0.10 1.0.x 1.0.99 -
medium
Insecure state generation
Update Socialite to
2.0.x 2.0.9 1.0.x 1.0.99 -
medium CVE-2015-4050
CVE-2015-4050: ESI unauthorized access
Only affects branches that no longer get security fixes
-
medium CVE-2015-2309
Unsafe methods in the Request class
Only affects branches that no longer get security fixes
-
medium CVE-2015-2308
Esi Code Injection
Only affects branches that no longer get security fixes
-
high CVE-2014-5245
Direct access of ESI URLs behind a trusted proxy
Only affects branches that no longer get security fixes
-
medium CVE-2014-6061
Security issue when parsing the Authorization header
Only affects branches that no longer get security fixes
-
high CVE-2014-5244
Denial of service with a malicious HTTP Host header
Only affects branches that no longer get security fixes
-
Only affects branches that no longer get security fixes
-
Only affects branches that no longer get security fixes
-
medium CVE-2013-5958
Possible DOS attack with long user-submitted passwords
Only affects branches that no longer get security fixes
-
medium CVE-2013-4752
Request::getHost() poisoning
Only affects branches that no longer get security fixes
-
Only affects branches that no longer get security fixes
-
medium CVE-2012-6431
Routes behind a firewall are accessible even when not logged in
Only affects branches that no longer get security fixes