Laravel/framework

This hub aggregates every CVE we track for Laravel/framework, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Laravel/framework.

• GHSA-crmm-hgp2-wgrpLaravel Framework: Temporary Signed URL Path ConfusionJun 17, 2026
• GHSA-5vg9-5847-vvmqLaravel Framework: CRLF injection in default email rule Jun 17, 2026
• CVE-2024-13919Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page8.0Mar 10, 2025
• CVE-2024-13918Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page8.0Mar 10, 2025
• CVE-2025-27515Laravel has a File Validation Bypass9.8Mar 5, 2025
• CVE-2024-52301Laravel allows environment manipulation via query string7.5Nov 12, 2024
• GHSA-wq8p-mqvg-2p5hlaravel framework SQL Injection via limit and offset functionsMay 15, 2024
• GHSA-jwvj-pwww-3mj5laravel framework Unexpected database bindings via requestsMay 15, 2024
• GHSA-44pg-c29v-hp6rLaravel Guard bypass in Eloquent modelsMay 15, 2024
• GHSA-qm5c-m76r-2hfrLaravel RCE vulnerability in "cookie" session driverMay 15, 2024
• GHSA-vr95-p7q6-8m9qLaravel Cross-site Scripting (XSS) vulnerability in blade templatingMay 15, 2024
• GHSA-6jvx-8ch9-j2jrLaravel Cookie serialization vulnerabilityMay 15, 2024
• GHSA-7852-w36x-6mf6Laravel Encrypter Component Potential Decryption Failure Leading to Unintended BehaviorMay 15, 2024
• GHSA-p62r-7637-3wwcLaravel Hijacked authentication cookies vulnerabilityMay 15, 2024
• GHSA-rj3w-99gc-8j58Laravel Risk of mass-assignment vulnerabilitiesMay 15, 2024