Vendor

    Laravel

    34 known vulnerabilities in products by Laravel, 2 of them actively exploited (CISA KEV).

    Key figures

    34

    Vulnerabilities

    2

    Actively exploited (KEV)

    0

    Used by ransomware

    10

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Laravel
    CriticalCVE-2025-54068

    Livewire vulnerable to remote command execution during property update hydration

    In CISA KEValso in 1 other product

    		9.8
    CriticalCVE-2018-15133

    Laravel Deserialization of Untrusted Data Vulnerability

    In CISA KEV

    		8.1
    HighCVE-2024-52301

    Laravel allows environment manipulation via query string

    also in 1 other product

    		7.5
    HighCVE-2024-55661

    Laravel Pulse Allows Remote Code Execution via Unprotected Query Method

    		8.8
    CriticalCVE-2021-43617

    Laravel Framework: security vulnerability

    		9.8
    HighCVE-2017-16894

    Laravel Framework: Information Disclosure

    		7.5
    HighCVE-2020-19316

    Laravel Framework: OS Command Injection

    		8.8
    CriticalCVE-2026-114509

    Laravel TokenGuard authentication bypass through non-string API credentials

    also in 1 other product

    		—
    CriticalCVE-2026-23524

    Laravel Redis Horizontal Scaling Insecure Deserialization

    		9.8
    CriticalCVE-2026-73683

    Laravel Socialite Facebook Provider Authentication Bypass via Nonce Replay

    		8.1
    CriticalCVE-2021-28254

    Laravel Framework: Deserialization of Untrusted Data

    		9.8
    HighCVE-2018-6330

    Laravel Framework: SQL Injection

    		8.8
    HighCVE-2026-48019

    CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay

    also in 1 other product

    		8.9
    HighCVE-2021-21263

    Query Binding Exploitation in Laravel

    		7.2
    CriticalCVE-2024-47823

    Livewire Remote Code Execution (RCE) on File Uploads

    also in 1 other product

    		9.8
    CriticalCVE-2025-27515

    Laravel has a File Validation Bypass

    		9.8
    HighCVE-2020-24940

    Laravel Framework: security vulnerability

    		7.5
    MediumCVE-2026-114508

    Laravel relationship inclusion can trigger unauthorized data destruction

    also in 1 other product

    		6.5
    HighCVE-2020-24941

    Laravel Framework: security vulnerability

    		7.5
    HighCVE-2022-25838

    Laravel Fortify: security vulnerability

    		8.1
    HighCVE-2024-13918

    Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page

    		8.0
    MediumCVE-2017-14775

    Laravel Framework: security vulnerability

    		5.9
    HighCVE-2024-13919

    Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page

    		8.0
    HighCVE-2024-22859

    Laravel Livewire: Cross-Site Request Forgery (CSRF)

    		8.8
    MediumCVE-2017-9303

    Laravel Framework: security vulnerability

    		6.1

    All vulnerabilities in search

    Products

    Products by Laravel
    Laravel Framework140
    Laravel101
    Laravel Livewire41