CVE Tools
Track your stack

Laravel

2 CVEs tracked since 2020. Since Sep 2020, none of them reached CISA KEV.

Laravel CVEs per month

Sep 2020 to Sep 2020. Point at a month, or focus the strip and use the arrow keys.
Laravel CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2020-0920

Products

The products that kept showing up in Laravel's monthly top three, with their CVEs summed over those months.

  1. Laravel21 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Laravel.

  1. CVE-2026-48019CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay8.9
  2. CVE-2026-73683Laravel Socialite Facebook Provider Authentication Bypass via Nonce Replay8.1
  3. CVE-2026-39976Laravel Passport's TokenGuard Authenticates Unrelated User for Client Credentials Tokens7.1
  4. CVE-2026-23524Laravel Redis Horizontal Scaling Insecure Deserialization9.8
  5. CVE-2021-47756Laravel Valet 2.0.3 - Local Privilege Escalation (macOS)8.4
  6. CVE-2025-54068Livewire vulnerable to remote command execution during property update hydration9.8
  7. CVE-2024-13919Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page8.0
  8. CVE-2024-13918Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page8.0
  9. CVE-2025-27515Laravel has a File Validation Bypass9.8
  10. CVE-2024-55661Laravel Pulse Allows Remote Code Execution via Unprotected Query Method8.8
  11. CVE-2024-52301Laravel allows environment manipulation via query string7.5
  12. CVE-2024-50347Laravel Reverb has Missing API Signature Verification—
  13. CVE-2024-47823Livewire Remote Code Execution (RCE) on File Uploads9.8
  14. CVE-2024-21504Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS) when a page uses [Url] for a property. An attacker can inject HTML code in the con...6.1
  15. CVE-2024-22859Cross-Site Request Forgery (CSRF) vulnerability in livewire before v3.0.4, allows remote attackers to execute arbitrary code getCsrfToken function. NOTE: the vendor disputes this because the 5d8873...8.8

The record

Peak rank
#160 in Sep 2020
Busiest month shown
Sep 2020, 2 CVEs
Months with a KEV entry
0 since Sep 2020
Monthly snapshots
1 since 2020
Laravel's full record, month by month

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store