Laravel vulnerabilities and fixes

CVEs that mention Laravel, ranked by priority. 10 tracked.

Laravel has 10 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 6. Most recent: 2026-10-21. Highest priority: CVE-2026-61609 (score 48/100).

• CVE-2026-61609 HIGH 7.5 Pterodactyl is a free, open-source game server management panel
• CVE-2026-114509 CRITICAL 9.2 Laravel is a web application framework
• CVE-2026-64665 HIGH 8.1 Statamic is a Laravel and Git powered content management system (CMS)
• CVE-2026-64663 MEDIUM 6.5 Statamic is a Laravel and Git powered content management system (CMS)
• CVE-2026-114508 MEDIUM 6.5 Laravel is a web application framework
• CVE-2026-71434 MEDIUM 5.3 Statamic is a Laravel and Git powered content management system (CMS)
• CVE-2026-73529 MEDIUM 5.3 Plainpad through 1.1.1, fixed in commit d3823fc, contains a missing rate limiting vulnerability that allows un
• CVE-2026-64662 MEDIUM 6.5 Statamic is a Laravel and Git powered content management system (CMS)
• CVE-2026-71435 MEDIUM 6.1 Statamic is a Laravel and Git powered content management system (CMS)
• CVE-2026-64664 MEDIUM 4.3 Statamic is a Laravel and Git powered content management system (CMS)

FAQ

How do I fix Laravel vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Laravel being exploited right now?

None of the tracked Laravel CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Laravel CVE should I patch first?

CVE-2026-61609 currently ranks highest (48/100): Pterodactyl is a free, open-source game server management panel.

← Back to latest CVEs