Feed live

The CMS vulnerability ledger.

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

335,499

All time

Critical · Active

10,538

CVSS ≥ 9.0

New · 14 days

707

Newly disclosed

Feed last synced

4 hrs ago

Data freshness

Showing 1–30 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-44692	high	7.7/10	Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint	Jun 10, 2026 16d ago
CVE-2026-48557	high	8.7/10	Spatie Laravel Media Library < 11.23.0 File Upload Restriction Bypass via FileAdder.php	May 29, 2026 28d ago
CVE-2026-48555	medium	5.3/10	Spatie Laravel Media Library < 11.23.0 SSRF via addMediaFromUrl()	May 29, 2026 28d ago
CVE-2026-7110	medium	5.1/10	code-projects Invoice System in Laravel item cross site scripting	Apr 27, 2026 2mo ago
CVE-2026-7109	medium	6.9/10	code-projects Invoice System in Laravel API Endpoint item improper authorization	Apr 27, 2026 2mo ago
CVE-2026-7108	medium	5.3/10	code-projects Invoice System in Laravel cross-site request forgery	Apr 27, 2026 2mo ago
CVE-2026-7107	medium	5.3/10	code-projects Invoice System in Laravel company unrestricted upload	Apr 27, 2026 2mo ago
CVE-2026-7093	medium	5.3/10	code-projects Invoice System in Laravel Invoice Endpoint invoice improper authorization	Apr 27, 2026 2mo ago
CVE-2026-7092	medium	5.3/10	code-projects Invoice System in Laravel Profile profile improper authorization	Apr 27, 2026 2mo ago
CVE-2026-7091	medium	5.3/10	code-projects Invoice System in Laravel User Management user improper authorization	Apr 27, 2026 2mo ago
CVE-2026-39976	high	7.1/10	Laravel Passport's TokenGuard Authenticates Unrelated User for Client Credentials Tokens	Apr 9, 2026 2mo ago
CVE-2026-35516	medium	5.0/10	LinkAce has SSRF via CheckLinksCommand - Link URL Update Bypasses laravel-html-meta Protection	Apr 7, 2026 2mo ago
CVE-2019-25673	high	8.7/10	UniSharp Laravel File Manager v2.0.0-alpha7 Arbitrary File Upload	Apr 5, 2026 2mo ago
CVE-2026-5370	medium	5.1/10	krayin laravel-crm Activities Module/Notes inbox.spec.ts composeMail cross site scripting	Apr 2, 2026 2mo ago
CVE-2026-4809	critical	9.3/10	Unsafe Client MIME Type Handling Can Enable Arbitrary File Upload in plank/laravel-mediable	Mar 26, 2026 3mo ago
CVE-2020-36950	high	8.7/10	Laravel Nova 3.7.0 - 'range' DoS	Jan 27, 2026 5mo ago
CVE-2026-23524	critical	9.8/10	Laravel Redis Horizontal Scaling Insecure Deserialization	Jan 21, 2026 5mo ago
CVE-2021-47756	high	8.4/10	Laravel Valet 2.0.3 - Local Privilege Escalation (macOS)	Jan 15, 2026 5mo ago
CVE-2021-47763	high	8.8/10	Aimeos Laravel ecommerce platform 2021.10 LTS - 'sort' SQL injection	Jan 15, 2026 5mo ago
CVE-2025-49130	medium	6.0/10	Laravel Translation Manager Vulnerable to Stored Cross-site Scripting	Jun 9, 2025 1y ago
CVE-2025-48490	medium	6.6/10	Laravel Rest Api has a Search Validation Bypass	May 30, 2025 1y ago
CVE-2024-13919	high	8.0/10	Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page	Mar 10, 2025 1y ago
CVE-2024-13918	high	8.0/10	Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page	Mar 10, 2025 1y ago
CVE-2024-55661	high	8.7/10	Laravel Pulse Allows Remote Code Execution via Unprotected Query Method	Dec 13, 2024 1y ago
CVE-2024-52301	high	8.7/10	Laravel allows environment manipulation via query string	Nov 12, 2024 1y ago
CVE-2024-50347	medium	6.3/10	Laravel Reverb has Missing API Signature Verification	Oct 31, 2024 1y ago
CVE-2024-7945	medium	5.3/10	itsourcecode Laravel Property Management System Notes Page create cross site scripting	Aug 20, 2024 1y ago
CVE-2024-7944	medium	5.3/10	itsourcecode Laravel Property Management System DocumentsController.php UpdateDocumentsRequest unrestricted upload	Aug 20, 2024 1y ago
CVE-2024-7943	medium	5.3/10	itsourcecode Laravel Property Management System PropertiesController.php upload unrestricted upload	Aug 20, 2024 1y ago
CVE-2024-7495	medium	5.3/10	itsourcecode Laravel Accounting System HomeController.php unrestricted upload	Aug 6, 2024 1y ago