Skip to content
laravel.now
Chronological feed

Now

Everything discovered across the Laravel and PHP ecosystem, newest first: releases, packages, security advisories, GitHub activity and tutorials.

EverythingPackagesReleasesSecurityGitHub activityTutorialsFramework changes
Any timeLast 24 hoursLast 7 daysLast 30 days
Most read

  1. Winter: CSRF through AJAX handler names reachable as backend page actions

    AdvisoryModerateCVE-2026-125339winter/wn-backend-moduleGitHub Advisory Database

  2. Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles

    AdvisoryModerateCVE-2026-125338winter/wn-backend-moduleGitHub Advisory Database

  3. Winter: ImportExportController AJAX handlers bypass granular import/export permission gate

    AdvisoryHighCVE-2026-125337winter/wn-backend-moduleGitHub Advisory Database

  4. Winter: My Account preview exposes another backend user's profile by record ID

    AdvisoryModerateCVE-2026-126061winter/wn-backend-moduleGitHub Advisory Database

  5. Winter: Stored XSS through Backend List widget image columns

    AdvisoryLowCVE-2026-125341winter/wn-backend-moduleGitHub Advisory Database

  6. Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS

    AdvisoryLowCVE-2026-52838alextselegidis/easyappointmentsGitHub Advisory Database

  7. Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync

    AdvisoryLowCVE-2026-52841alextselegidis/easyappointmentsGitHub Advisory Database

  8. Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network

    AdvisoryLowCVE-2026-52840alextselegidis/easyappointmentsGitHub Advisory Database

  9. FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCE

    AdvisoryCriticalCVE-2026-77526facturascripts/facturascriptsGitHub Advisory Database

  10. FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of `Tools::noHtml`-escaped quotes inside `onclick=`

    AdvisoryLowCVE-2026-45710facturascripts/facturascriptsGitHub Advisory Database

  11. FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export

    AdvisoryHighCVE-2026-45263facturascripts/facturascriptsGitHub Advisory Database

  12. FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`

    AdvisoryCriticalCVE-2026-45262facturascripts/facturascriptsGitHub Advisory Database

  13. Filament: Disabled RichEditor field state can be used for XSS

    In Filament v3, a disabled RichEditor field rendered its raw state without sanitizing HTML. Where the data stored in this field's state isn't sanitized already when the form state was filled, an attacker could plant malicious HTML or JavaS…

    AdvisoryHighCVE-2026-55409filament/formsGitHub Advisory Database

  14. Laravel Framework: Temporary Signed URL Path Confusion

    A vulnerability in Laravel's local filesystem driver allows temporary signed URLs to be parsed ambiguously, potentially misrouting requests and bypassing expiration enforcement. Under certain conditions, a generated temporary signed URL ca…

    AdvisoryModerateGHSA-crmm-hgp2-wgrplaravel/frameworkPackagist security advisories

  15. Laravel Framework: CRLF injection in default email rule

    AdvisoryHighCVE-2026-48019laravel/frameworkPackagist security advisories

  16. Twig: PHP code injection via `{% use %}` template name

    AdvisoryCriticalCVE-2026-46633twig/twigGitHub Advisory Database

  17. Composer has a command injection via malicious perforce repository

    AdvisoryHighCVE-2026-40176composer/composerGitHub Advisory Database

  18. Livewire is vulnerable to remote command execution during component property update hydration

    AdvisoryCriticalCVE-2025-54068livewire/livewirePackagist security advisories

  19. Laravel framework susceptible to reflected cross-site scripting

    The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page.

    AdvisoryModerateCVE-2024-13918laravel/frameworkPackagist security advisories

  20. Laravel framework susceptible to reflected cross-site scripting

    The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in the debug-mode error page.

    AdvisoryModerateCVE-2024-13919laravel/frameworkPackagist security advisories
laravel.now

The PHP and Laravel ecosystem, live.

laravel.now is an independent community project. It is not affiliated with, endorsed by, sponsored by, or in any way officially connected to Laravel, Laravel LLC, Taylor Otwell, or the Laravel framework maintainers. Laravel is a trademark of Taylor Otwell. All other trademarks belong to their respective owners.

This site is operated by the makers of Lockhound. Links to Lockhound are promotional.