L
Vendor security profile3 actively exploited CVEs
Laravel
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs6
Critical0
CISA KEV3
Public exploit4
Patch rate%17
Avg. CVSS6.5
12-month vulnerability rate
0
0
1
0
1
0
0
0
0
1
1
0
CVE KEV
CVE severity distribution
6toplam CVE
High2 (33%)
Low1 (17%)
Uncertain3 (50%)
Patch and exploitation view
%17
Verified patch
%50
CISA KEV
%67
Public exploit
1Patch available
0Partial
3Workaround
0Vendor: no patch
2Unknown
Latest vulnerabilities
3.1
CVE-2026-102279
Laravel: XSS in Debug Page Information
L
Patch status unknownEPSS %0
5.4
CVE-2026-54181
backpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted
L
Patch verifiedEPSS %0
6.6
CVE-2026-54177
backpack/crud: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver
L
Patch verifiedEPSS %1
6.5
CVE-2026-54176
backpack/crud: MyAccountController allows changing the login email without a current-password check
L
Patch verifiedEPSS %1
7.6
CVE-2026-54180
backpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)
L
Patch verifiedEPSS %0
6.5
CVE-2026-57570
backpack/crud: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
L
Patch verifiedEPSS %0
8.1
CVE-2026-54178
backpack/crud: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
L
Patch verifiedEPSS %1
8.1
CVE-2026-54182
backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)
L
Patch verifiedEPSS %1
7.6
CVE-2026-54175
backpack/crud: Unverified password change in MyAccountController via mass assignment
L
Patch verifiedEPSS %1
4.4
CVE-2026-54179
backpack/crud: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk
L
Patch verifiedEPSS %0