# laravel/framework (Packagist) vulnerabilities Source: https://junglewise.ai/threats/technologies/packagist-laravel-framework Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/packagist-laravel-framework.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 28 vulnerabilities in laravel/framework (Packagist): 0 in the last 7 days and 4 in the last 90 days, 2 of them critical and 1 exploited in the wild. The most recent, CVE-2026-114509, was published on 21 October 2026. 2 vulnerabilities in the last four weeks, up 100% on the four before (1). 1 critical against 0. ## Counts - Last 7 days: 0 - Last 30 days: 2 - Last 90 days: 4 - All time: 28 (2 critical, 1 exploited in the wild) ## About laravel/framework (Packagist) Laravel web application framework providing tools for building PHP web applications with MVC architecture. ## Latest laravel/framework (Packagist) vulnerabilities - [CVE-2026-114509: Laravel TokenGuard authentication bypass via non-string credential](https://junglewise.ai/threats/cve-2026-114509-laravel-is-a-web-application-framework-prior-to-12-68-0-and-13) (critical, CVSS 4, published 21 Oct 2026) - [CVE-2026-114508: Laravel privilege escalation in read-only endpoints](https://junglewise.ai/threats/cve-2026-114508-laravel-is-a-web-application-framework-from-12-45-0-until-12-68) (medium, CVSS 6.5, published 21 Oct 2026) - [CVE-2026-102279: Laravel: XSS in Debug Page Information](https://junglewise.ai/threats/cve-2026-102279-laravel-is-a-web-application-framework-prior-to-12-69-0-and-13) (low, CVSS 3.1, published 28 Sep 2026) - [CVE-2026-48019: Laravel CRLF injection in email validation](https://junglewise.ai/threats/cve-2026-48019-laravel-crlf-injection-in-email-validation) (high, CVSS 8.9, published 4 Sep 2026) - [CVE-2024-13919: Laravel framework susceptible to reflected cross-site scripting](https://junglewise.ai/threats/cve-2024-13919-laravel-framework-susceptible-to-reflected-cross-site-scripting) (low, CVSS 3.1, published 10 Mar 2025) - [CVE-2024-13918: Laravel framework susceptible to reflected cross-site scripting](https://junglewise.ai/threats/cve-2024-13918-laravel-framework-susceptible-to-reflected-cross-site-scripting) (low, CVSS 3.1, published 10 Mar 2025) - [CVE-2025-27515: Laravel has a File Validation Bypass](https://junglewise.ai/threats/cve-2025-27515-laravel-has-a-file-validation-bypass) (medium, CVSS 4, published 5 Mar 2025) - [CVE-2024-52301: Laravel environment manipulation via query string](https://junglewise.ai/threats/cve-2024-52301-laravel-environment-manipulation-via-query-string) (low, CVSS 3.1, published 12 Nov 2024) - [laravel framework SQL Injection via limit and offset functions](https://junglewise.ai/threats/laravel-framework-sql-injection-via-limit-and-offset-functions-529b0dd6) (info, published 15 May 2024) - [laravel framework Unexpected database bindings via requests](https://junglewise.ai/threats/laravel-framework-unexpected-database-bindings-via-requests-8c368592) (info, published 15 May 2024) - [Laravel Guard bypass in Eloquent models](https://junglewise.ai/threats/laravel-guard-bypass-in-eloquent-models-5acc1e56) (info, published 15 May 2024) - [Laravel RCE vulnerability in "cookie" session driver](https://junglewise.ai/threats/laravel-rce-vulnerability-in-cookie-session-driver-4c881550) (low, CVSS 3.1, published 15 May 2024) - [Laravel Cross-site Scripting (XSS) vulnerability in blade templating](https://junglewise.ai/threats/laravel-cross-site-scripting-xss-vulnerability-in-blade-templating-edae5d8d) (low, CVSS 3.1, published 15 May 2024) - [Laravel Cookie serialization vulnerability](https://junglewise.ai/threats/laravel-cookie-serialization-vulnerability-549f7ca6) (info, published 15 May 2024) - [Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior](https://junglewise.ai/threats/laravel-encrypter-component-potential-decryption-failure-leading-to-f3c1d82e) (info, published 15 May 2024) - [Laravel Hijacked authentication cookies vulnerability](https://junglewise.ai/threats/laravel-hijacked-authentication-cookies-vulnerability-6456e2ff) (info, published 15 May 2024) - [Laravel Risk of mass-assignment vulnerabilities](https://junglewise.ai/threats/laravel-risk-of-mass-assignment-vulnerabilities-0f54c40f) (info, published 15 May 2024) - [CVE-2017-9303: Laravel does not properly constrain the host portion of a password-reset URL](https://junglewise.ai/threats/cve-2017-9303-laravel-does-not-properly-constrain-the-host-portion-of-a-password) (low, CVSS 3, published 17 May 2022) - [CVE-2017-14775: Laravel Sensitive Data Exposure](https://junglewise.ai/threats/cve-2017-14775-laravel-sensitive-data-exposure) (low, CVSS 3, published 17 May 2022) - [CVE-2019-9081: Laravel Framework Deserialization Vulnerability](https://junglewise.ai/threats/cve-2019-9081-laravel-framework-deserialization-vulnerability) (low, CVSS 3, published 14 May 2022) - [CVE-2018-15133: Laravel Framework RCE Vulnerability](https://junglewise.ai/threats/cve-2018-15133-laravel-deserialization-of-untrusted-data-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 14 May 2022) - [CVE-2020-19316: OS Command Injection in Laravel Framework](https://junglewise.ai/threats/cve-2020-19316-os-command-injection-in-laravel-framework) (low, CVSS 3.1, published 6 Jan 2022) - [CVE-2021-43808: Laravel Framework XSS in Blade templating engine](https://junglewise.ai/threats/cve-2021-43808-laravel-framework-xss-in-blade-templating-engine) (low, CVSS 3.1, published 8 Dec 2021) - [CVE-2021-43617: Withdrawn: Laravel Framework does not sufficiently block the upload of executable PHP content.](https://junglewise.ai/threats/cve-2021-43617-withdrawn-laravel-framework-does-not-sufficiently-block-the) (info, published 16 Nov 2021) - [CVE-2020-24941: Improper Input Validation in Laravel](https://junglewise.ai/threats/cve-2020-24941-improper-input-validation-in-laravel) (low, CVSS 3.1, published 6 May 2021) ## Most severe laravel/framework (Packagist) vulnerabilities - [CVE-2018-15133: Laravel Framework RCE Vulnerability](https://junglewise.ai/threats/cve-2018-15133-laravel-deserialization-of-untrusted-data-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 14 May 2022) - [CVE-2026-114509: Laravel TokenGuard authentication bypass via non-string credential](https://junglewise.ai/threats/cve-2026-114509-laravel-is-a-web-application-framework-prior-to-12-68-0-and-13) (critical, CVSS 4, published 21 Oct 2026) - [CVE-2026-48019: Laravel CRLF injection in email validation](https://junglewise.ai/threats/cve-2026-48019-laravel-crlf-injection-in-email-validation) (high, CVSS 8.9, published 4 Sep 2026) - [CVE-2026-114508: Laravel privilege escalation in read-only endpoints](https://junglewise.ai/threats/cve-2026-114508-laravel-is-a-web-application-framework-from-12-45-0-until-12-68) (medium, CVSS 6.5, published 21 Oct 2026) - [CVE-2025-27515: Laravel has a File Validation Bypass](https://junglewise.ai/threats/cve-2025-27515-laravel-has-a-file-validation-bypass) (medium, CVSS 4, published 5 Mar 2025) - [CVE-2024-52301: Laravel environment manipulation via query string](https://junglewise.ai/threats/cve-2024-52301-laravel-environment-manipulation-via-query-string) (low, CVSS 3.1, published 12 Nov 2024) - [CVE-2020-19316: OS Command Injection in Laravel Framework](https://junglewise.ai/threats/cve-2020-19316-os-command-injection-in-laravel-framework) (low, CVSS 3.1, published 6 Jan 2022) - [CVE-2021-21263: Query Binding Exploitation](https://junglewise.ai/threats/cve-2021-21263-query-binding-exploitation) (low, CVSS 3.1, published 19 Jan 2021) - [CVE-2020-24941: Improper Input Validation in Laravel](https://junglewise.ai/threats/cve-2020-24941-improper-input-validation-in-laravel) (low, CVSS 3.1, published 6 May 2021) - [CVE-2021-43808: Laravel Framework XSS in Blade templating engine](https://junglewise.ai/threats/cve-2021-43808-laravel-framework-xss-in-blade-templating-engine) (low, CVSS 3.1, published 8 Dec 2021) ## Vulnerabilities per week 2 vulnerabilities in the last four weeks, up 100% on the four before (1). 1 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 1 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 1 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 2 | 1 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Packagist technologies - [moodle/moodle (Packagist)](https://junglewise.ai/threats/technologies/moodle-moodle): 434 vulnerabilities - [magento/community-edition (Packagist)](https://junglewise.ai/threats/technologies/packagist-magento-community-edition): 362 vulnerabilities - [typo3/cms (Packagist)](https://junglewise.ai/threats/technologies/packagist-typo3-cms): 187 vulnerabilities - [wwbn/avideo (Packagist)](https://junglewise.ai/threats/technologies/wwbn-avideo): 164 vulnerabilities - [magento/project-community-edition (Packagist)](https://junglewise.ai/threats/technologies/magento-project-community-edition): 161 vulnerabilities - [drupal/core (Packagist)](https://junglewise.ai/threats/technologies/packagist-drupal-core): 150 vulnerabilities - [pimcore/pimcore (Packagist)](https://junglewise.ai/threats/technologies/pimcore-pimcore): 145 vulnerabilities - [craftcms/cms (Packagist)](https://junglewise.ai/threats/technologies/craftcms-cms): 143 vulnerabilities - [dolibarr/dolibarr (Packagist)](https://junglewise.ai/threats/technologies/dolibarr-dolibarr): 127 vulnerabilities - [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav): 127 vulnerabilities - [typo3/cms-core (Packagist)](https://junglewise.ai/threats/technologies/typo3-cms-core): 127 vulnerabilities - [concrete5/concrete5 (Packagist)](https://junglewise.ai/threats/technologies/concrete5-concrete5): 122 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "laravel/framework (Packagist) vulnerabilities", https://junglewise.ai/threats/technologies/packagist-laravel-framework, 9 November 2026.