From GitHub and Packagist
Verified stats
- GitHub stars
- 35k
- Monthly downloads
- 24.6M
- Total downloads
- 621.7M
- Forks
- 12k
- Open issues
- 92
- Dependents
- 22k
Stats last synced . A dash means the value was not available from the source.
From the package author
The Laravel Framework.
Known advisories from checked public sources
Dependency security
30 known advisoriesLast checked
- Critical9.2CVE-2026-114509
Laravel TokenGuard authentication bypass through non-string API credentials
- Affected
>=13.0.0,<13.27.0 || >=12.0.0,<12.68.0 || >=11.0.0,<11.56.1 || <10.50.4- Fixed in
10.50.4, 11.56.1, 12.68.0, 13.27.0
- Critical9.9GHSA-qm5c-m76r-2hfr
Laravel RCE vulnerability in "cookie" session driver
- Affected
>=4.1.0,<6.18.31 || >=7.0.0,<7.22.4- Fixed in
6.18.31, 7.22.4
- Critical9.8CVE-2019-9081
Laravel Framework Deserialization Vulnerability
- Affected
>=5.7.0,<6.20.44- Fixed in
6.20.44
- High8.9CVE-2026-48019
Laravel Framework: CRLF injection in default email rule
- Affected
>=13.0.0,<13.10.0 || <12.60.0- Fixed in
12.60.0, 13.10.0
- High0.0CVE-2024-52301
Laravel environment manipulation via query string
- Affected
<6.20.45 || >=7.0.0,<7.30.7 || >=8.0.0,<8.83.28 || >=9.0.0,<9.52.17 || >=10.0.0,<10.48.23 || >=11.0.0,<11.31.0- Fixed in
6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, 11.31.0
- HighGHSA-wq8p-mqvg-2p5h
laravel framework SQL Injection via limit and offset functions
- Affected
>=6.0.0,<6.20.26 || >=7.0.0,<7.30.5 || >=8.0.0,<8.40.0- Fixed in
6.20.26, 7.30.5, 8.40.0
- HighGHSA-jwvj-pwww-3mj5
laravel framework Unexpected database bindings via requests
- Affected
>=6.0.0,<6.20.14 || >=7.0.0,<7.30.4 || >=8.0.0,<8.24.0- Fixed in
6.20.14, 7.30.4, 8.24.0
- HighGHSA-6jvx-8ch9-j2jr
Laravel Cookie serialization vulnerability
- Affected
>=5.5.0,<5.6.30- Fixed in
5.6.30
- High8.1CVE-2018-15133
Laravel Framework RCE Vulnerability
- Affected
<=5.5.40 || >=5.6.0,<5.6.30- Fixed in
5.6.30
- High8.8CVE-2020-19316
OS Command Injection in Laravel Framework
- Affected
<5.8.17- Fixed in
5.8.17
- High7.5CVE-2020-24941
Improper Input Validation in Laravel
- Affected
<6.18.35 || >=7.0.0,<7.24.0- Fixed in
6.18.35, 7.24.0
- HighGHSA-4mg9-vhxq-vm7j
SQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/database
- Affected
>=8.0.0,<8.40.0 || <6.20.26- Fixed in
6.20.26, 8.40.0
- High7.2GHSA-x7p5-p2c9-phvg
Unexpected database bindings
- Affected
<6.20.14 || >=7.0.0,<7.30.4 || >=8.0.0,<8.24.0- Fixed in
6.20.14, 7.30.4, 8.24.0
- High7.2CVE-2021-21263
Query Binding Exploitation
- Affected
>=8.0.0,<8.22.1 || >=6.0.0,<6.20.11 || >=7.0.0,<7.30.2- Fixed in
6.20.11, 7.30.2, 8.22.1
- Moderate6.5CVE-2026-114508
Laravel relationship inclusion can trigger unauthorized data destruction
- Affected
>=12.45.0,<12.68.0 || >=13.0.0,<13.27.0- Fixed in
12.68.0, 13.27.0
- Moderate4.2GHSA-crmm-hgp2-wgrp
Laravel Framework: Temporary Signed URL Path Confusion
- Affected
>=13.0.0,<13.12.0 || <12.61.1- Fixed in
12.61.1, 13.12.0
- Moderate4.7CVE-2024-13919
Laravel framework susceptible to reflected cross-site scripting
- Affected
>=11.9.0,<11.36.0- Fixed in
11.36.0
- Moderate4.7CVE-2024-13918
Laravel framework susceptible to reflected cross-site scripting
- Affected
>=11.9.0,<11.36.0- Fixed in
11.36.0
- ModerateCVE-2025-27515
Laravel has a File Validation Bypass
- Affected
>=12.0.0,<12.1.1 || >=11.0.0,<11.44.1 || <10.48.29- Fixed in
10.48.29, 11.44.1, 12.1.1
- ModerateGHSA-44pg-c29v-hp6r
Laravel Guard bypass in Eloquent models
- Affected
>=5.5.0,<=5.5.49 || >=6.0.0,<6.18.34 || >=7.0.0,<7.23.2- Fixed in
6.18.34, 7.23.2
- Moderate4.3GHSA-vr95-p7q6-8m9q
Laravel Cross-site Scripting (XSS) vulnerability in blade templating
- Affected
>=7.0.0,<7.1.2- Fixed in
7.1.2
- ModerateGHSA-7852-w36x-6mf6
Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior
- Affected
<5.5.40 || >=5.6.0,<5.6.15- Fixed in
5.5.40, 5.6.15
- ModerateGHSA-p62r-7637-3wwc
Laravel Hijacked authentication cookies vulnerability
- Affected
>=4.0.0,<4.1.26- Fixed in
4.1.26
- ModerateGHSA-rj3w-99gc-8j58
Laravel Risk of mass-assignment vulnerabilities
- Affected
>=4.0.0,<4.1.29- Fixed in
4.1.29
- Moderate6.1CVE-2017-9303
Laravel does not properly constrain the host portion of a password-reset URL
- Affected
>=5.3.0,<=5.3.31 || >=5.4.0,<5.4.22- Fixed in
5.4.22
- Moderate5.9CVE-2017-14775
Laravel Sensitive Data Exposure
- Affected
<5.5.10- Fixed in
5.5.10
- Moderate6.1CVE-2021-43808
Laravel Framework XSS in Blade templating engine
- Affected
<6.20.42 || >=7.0.0,<7.30.6 || >=8.0.0,<8.75.0- Fixed in
6.20.42, 7.30.6, 8.75.0
- Low2.3CVE-2026-128083
Laravel: Task Output Injection - Concurrency Process
- Affected
<12.71.0 || >=13.0.0,<13.40.0- Fixed in
12.71.0, 13.40.0
- Low3.1CVE-2026-102279
Laravel: XSS in Debug Page Information
- Affected
<12.69.0 || >=13.0.0,<13.30.0- Fixed in
12.69.0, 13.30.0
- Severity not providedCVE-2021-43617
Image upload bypass
- Affected
>=8.0.0,<8.71.0- Fixed in
8.71.0
Most recent first