Skip to content
laravel.now
Chronological feed

Now

Everything discovered across the Laravel and PHP ecosystem, newest first: releases, packages, security advisories, GitHub activity and tutorials.

EverythingPackagesReleasesSecurityGitHub activityTutorialsFramework changes
Any timeLast 24 hoursLast 7 daysLast 30 days
Most read

  1. Laravel: Task Output Injection - Concurrency Process

    AdvisoryLowCVE-2026-128083laravel/frameworkPackagist security advisories

  2. code16/sharp: Server-side request forgery through an unanchored autocomplete endpoint check

    AdvisoryModerateCVE-2026-84987code16/sharpGitHub Advisory Database

  3. code16/sharp: Arbitrary class instantiation through the embed_key API parameter

    AdvisoryModerateCVE-2026-84974code16/sharpGitHub Advisory Database

  4. FileGator: Missing authorization in POST /upload allows cross-user read and deletion of temporary files

    AdvisoryModerateCVE-2026-94619filegator/filegatorGitHub Advisory Database

  5. FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive

    AdvisoryModerateCVE-2026-94618filegator/filegatorGitHub Advisory Database

  6. PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling

    AdvisoryModerateCVE-2026-119193phpunit/phpunitGitHub Advisory Database

  7. AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE

    AdvisoryModerateCVE-2026-96634adminneo-org/adminneoGitHub Advisory Database

  8. AdminNeo SQLite Database-List Drop Arbitrary File Deletion

    AdvisoryHighCVE-2026-96633adminneo-org/adminneoGitHub Advisory Database

  9. AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers

    AdvisoryHighCVE-2026-96631adminneo-org/adminneoGitHub Advisory Database

  10. AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)

    AdvisoryHighCVE-2026-96632adminneo-org/adminneoGitHub Advisory Database

  11. MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow

    AdvisoryModerateCVE-2026-55186silverstripe/mfaGitHub Advisory Database

  12. Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter

    AdvisoryHighCVE-2026-33944dolibarr/dolibarrGitHub Advisory Database

  13. Laravel TokenGuard authentication bypass through non-string API credentials

    Laravel's built-in TokenGuard, when configured with a standard token-based API guard, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token. Under certain database configurations (MySQL/Ma…

    AdvisoryCriticalCVE-2026-114509laravel/frameworkPackagist security advisories

  14. Laravel relationship inclusion can trigger unauthorized data destruction

    A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than s…

    AdvisoryModerateCVE-2026-114508laravel/frameworkPackagist security advisories

  15. Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order

    AdvisoryModerateGHSA-mhf7-xp6r-6qrclivewire/livewirePackagist security advisories
laravel.now

The PHP and Laravel ecosystem, live.

laravel.now is an independent community project. It is not affiliated with, endorsed by, sponsored by, or in any way officially connected to Laravel, Laravel LLC, Taylor Otwell, or the Laravel framework maintainers. Laravel is a trademark of Taylor Otwell. All other trademarks belong to their respective owners.

This site is operated by the makers of Lockhound. Links to Lockhound are promotional.