CVE-2026-114508Medium· 6.5▾ SunlitLaravel relationship inclusion can trigger unauthorized data destruction
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.3%
0.3% → 0.4%
A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data.
A user with only read access could cause irreversible data loss (e.g., a related table being emptied), without needing any write permissions. This could result in denial of service and loss of data integrity for affected applications.
laravel/framework >= 12.45.0, < 12.68.0laravel/framework >= 13.0.0, < 13.27.0Upgrade to a patched release:
laravel/framework 12.68.0laravel/framework 13.27.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114509Critical· 9.2Laravel TokenGuard authentication bypass through non-string API credentials
GHSA-5vg9-5847-vvmqHigh· 8.9Laravel Framework: CRLF injection in default email rule
GHSA-crmm-hgp2-wgrpMedium· 4.2Laravel Framework: Temporary Signed URL Path Confusion
CVE-2026-102279Low· 3.1Laravel is a web application framework
CVE-2026-65608High· 8.8Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability
CVE-2026-69088High· 8.1Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class::method) in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall() only applies its dangerous-callable denylist to stri…