laravel has 6 CVEs on record. Disclosure cadence is accelerating: 4 in the last 90 days against 2 in the 90 before. The median CVSS is 7.7 (high), with 1 rated critical. None have a confirmed exploitation report. Most affected products: laravel/framework (4), framework (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.7
- Publish → KEV
- —
- Last 90 days
- 4 prev 2
Weakness classes
Products
- laravel/framework 4
- framework 2
Worst active — by depth score
CVE-2026-114509Critical· 9.2Laravel TokenGuard authentication bypass through non-string API credentials63CVE-2026-48019High· 8.9Laravel is a web application framework61GHSA-5vg9-5847-vvmqHigh· 8.9Laravel Framework: CRLF injection in default email rule 49CVE-2026-114508Medium· 6.5Laravel relationship inclusion can trigger unauthorized data destruction36GHSA-crmm-hgp2-wgrpMedium· 4.2Laravel Framework: Temporary Signed URL Path Confusion23
laravel vulnerabilities
CVEs affecting laravel, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-114508Medium· 6.5Laravel relationship inclusion can trigger unauthorized data destruction
Laravel relationship inclusion can trigger unauthorized data destruction
CVE-2026-114509Critical· 9.2PoCLaravel TokenGuard authentication bypass through non-string API credentials
Laravel TokenGuard authentication bypass through non-string API credentials
CVE-2026-102279Low· 3.1Laravel is a web application framework
Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site sc…
CVE-2026-48019High· 8.9PoCLaravel is a web application framework
Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may …
GHSA-5vg9-5847-vvmqHigh· 8.9Laravel Framework: CRLF injection in default email rule
Laravel Framework: CRLF injection in default email rule
GHSA-crmm-hgp2-wgrpMedium· 4.2Laravel Framework: Temporary Signed URL Path Confusion
Laravel Framework: Temporary Signed URL Path Confusion