PatchTheCVEwinter vulnerabilities and fixes
Recent CVEs affecting winter, with upgrade or downgrade steps. 2 tracked.
winter has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2026-02-06. Highest priority: CVE-2024-54149 (score 38/100).
- CVE-2026-22254 NONE 0.0 UPGRADE Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework
- CVE-2024-54149 HIGH 8.4 UPGRADE Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework
FAQ
How do I fix winter vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is winter being exploited right now?
None of the tracked winter CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which winter CVE should I patch first?
CVE-2024-54149 currently ranks highest (38/100): Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework.