Laravel
In 4 briefs, most recently 26 May 2026. RSS for this tag
Learn more: Vulnerabilities (NVD) ↗
Known exploited (CISA KEV)
3 Laravel vulnerabilities are on CISA's list of vulnerabilities exploited in the wild, 1 of them used in ransomware campaigns. Most recent:
- CVE-2025-54068 Laravel Livewire Code Injection Vulnerability
- CVE-2018-15133 Laravel Deserialization of Untrusted Data Vulnerability
- CVE-2021-3129 Laravel Ignition File Upload Vulnerability
Coverage in DanSec Daily
- 7-Eleven breach by ShinyHunters, Ghost CMS CVE-2026-26980 exploited for ClickFix attacks on 700+ sites, and TeamPCP supply chain campaign reaching GitHub.
- Supply chain attacks on Packagist and Laravel-Lang PHP packages abusing GitHub releases, Anthropic's Project Glasswing finding 10,000+ flaws, and the …
- The Trivy supply chain attack by TeamPCP, Oracle Identity Manager flaw CVE-2026-21992, and Iranian cyberattacks disrupting Maryland hospitals.
- Laravel apps exposed via leaked APP_KEYs, Wing FTP Server RCE exploited in the wild, and Scattered Spider arrests.