CVE-2026-121589Medium· 5.3▾ SunlitA weakness has been identified in spatie url-signer up to 2.1.3. Affected is the function AbstractUrlSigner::validate of the file AbstractUrlSigner.php of the component URL Validation. This manipulation of the argument expires causes inc…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
A weakness has been identified in spatie url-signer up to 2.1.3. Affected is the function AbstractUrlSigner::validate of the file AbstractUrlSigner.php of the component URL Validation. This manipulation of the argument expires causes incorrect type conversion. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.1.4 is able to address this issue. Patch name: 86af3355388210668f6bfbe9007bd6545d4942ad. It is recommended to upgrade the affected component.
url-signer 2.1.0url-signer 2.1.1url-signer 2.1.2url-signer 2.1.3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-48557High· 8.8Spatie Laravel Media Library before version 11.23.0 contains a file upload restriction bypass in FileAdder::defaultSanitizer()
CVE-2026-48555High· 7.4Spatie Laravel Media Library before version 11.23.0 contains a server-side request forgery vulnerability that allows remote attackers to cause the server to issue arbitrary outbound HTTP requests by passing user-controlled URLs to the ad…
CVE-2026-93533Medium· 6.3A vulnerability was determined in spatie Scotty up to 1.4.4
CVE-2026-93534Medium· 6.3A vulnerability was identified in spatie Scotty up to 1.4.2
CVE-2026-17211Medium· 4.3Multiple Vulnerabilities in IBM API Connect
CVE-2026-122319High· 7.5Kyverno before 1.19.2 Denial of Service via In/NotIn Operator Panic