Laravel

laravel.com ↗
D
RISKY
15
Total CVEs
4
Crit / High
0
Medium
13%
Unpatched
27%
Patched
8.2
Avg CVSS
0
CISA KEV
// Data sourced from NVD · CISA KEV · RHSA · GHSA · Debian · OSV · EPSS · Exploit-DB How we collect data →
// INTEL UPGRADE
Full Company Dossier — Coming Soon
Executive profiles, financial exposure, M&A risk, breach history & supply-chain threat mapping — all in one place.
OSINT FINANCIALS EXEC PROFILES BREACH DB
▸ CVE Trend by Year
▸ Patch Coverage
Patched
27%
Unpatched
13%
Under Review
33%
Pending
27%
✓ 4 patched ✗ 2 unpatched ~ 5 under review ⏳ 4 pending score
▸ Intelligence by Audience
PoC Available
6 / 20 shown
CISA KEV (Exploited)
0
Shodan Dorks
ssl:"laravel" port:443
org:"Laravel" http.status:200
Top EPSS (Exploitation Probability)
CVE-2024-52301 44.76% exploitation probability
CVE-2024-55661 29.54% exploitation probability
CVE-2024-51152 2.59% exploitation probability
CVE-2024-29291 1.34% exploitation probability
CVE-2026-61701 0.76% exploitation probability
Quick Facts for Reporting
Total CVEs tracked
15
Critical severity
1
Actively exploited (CISA)
0
Unpatched ratio
13%
Avg CVSS score
8.2
Security grade
D (RISKY)
NVD Data Attribution
Source: NIST National Vulnerability Database (NVD) + GitHub Advisory Database.
Data aggregated by Valters IT Hub · valtersit.com
Last updated: 2026-06-10
Security Risk Score (for investors)
LOW
Vuln Volume
GOOD
Patch Responsiveness
LOW
CISA Exposure
⚠ Not financial advice. Past security incidents do not guarantee future stock performance.
▸ Security News Google News
CISA Flags Apple, Craft CMS, Laravel Bugs in KEV, Orders Patching by April 3, 2026 - The Hacker News
The Hacker News 2026-03-21
Laravel-Lang Packages Poisoned for Malware Delivery - SecurityWeek
SecurityWeek 2026-05-25
Laravel Livewire Applications Compromised to Steal Credentials Exploiting RCE Vulnerability - CyberSecurityNews
CyberSecurityNews 2026-06-24
Find the Security Vulnerabilities in Your Laravel App with Sensagraph - Laravel News
Laravel News 2026-07-13
Laravel CRLF Injection Flaw Could Disrupt Outbound Email Handling - GBHackers News
GBHackers News 2026-06-03
Laravel-Lang PHP Packages Compromised to Deliver Cross-Platform Credential Stealer - The Hacker News
The Hacker News 2026-05-23
▸ Recent CVEs showing 20 of 15
CVE IDSeverityPatchEPSSDate
CVE-2026-102628 9.3 CRITICAL UNKNOWN / UNPATCHED — 2026-10-01
CVE-2026-102279 PoC 3.1 LOW PATCH UNDER REVIEW 0.20% 2026-09-28
CVE-2026-61701 PoC 8.8 HIGH PATCH UNDER REVIEW 0.76% 2026-09-14
CVE-2026-48019 8.9 HIGH PATCH UNDER REVIEW 0.51% 2026-09-04
CVE-2026-73683 8.1 HIGH PATCH UNDER REVIEW 0.44% 2026-08-14
CVE-2021-47756 8.4 HIGH UNKNOWN / UNPATCHED 0.21% 2026-01-15
CVE-2025-49130 6.0 MEDIUM PATCHED / FIX AVAILABLE 0.42% 2025-06-09
CVE-2025-26159 ? N/A UNKNOWN / UNPATCHED 0.29% 2025-04-22
CVE-2025-27515 6.9 MEDIUM PATCHED / FIX AVAILABLE 0.75% 2025-03-05
CVE-2024-55661 PoC 8.7 HIGH PATCH UNDER REVIEW 29.54% 2024-12-13
CVE-2024-52301 8.7 HIGH PATCHED / FIX AVAILABLE 44.76% 2024-11-12
CVE-2024-51152 PoC ? N/A UNKNOWN / UNPATCHED 2.59% 2024-11-08
CVE-2024-50347 6.3 MEDIUM PATCHED / FIX AVAILABLE 0.35% 2024-10-31
CVE-2024-40075 PoC ? N/A UNKNOWN / UNPATCHED 0.09% 2024-07-22
CVE-2024-29291 PoC ? N/A UNKNOWN / UNPATCHED 1.34% 2024-04-16
View all 15 CVEs for Laravel →
▸Intel
Founded2011
CEOTaylor Otwell
Trust ScoreD — RISKY
Max CVSS9.8
Last Updated2026-06-10
▸Top Weaknesses
CWE-79
Cross-Site Scripting (XSS)
4 occurrences in Laravel CVEs (27% of total)
CWE-79 ⓘ
4
CWE-20
Unknown Weakness Type
1 occurrence in Laravel CVEs (7% of total)
CWE-20 ⓘ
1
CWE-306
Missing Authentication
1 occurrence in Laravel CVEs (7% of total)
CWE-306 ⓘ
1
CWE-807
Unknown Weakness Type
1 occurrence in Laravel CVEs (7% of total)
CWE-807 ⓘ
1
CWE-611
XML External Entity (XXE)
1 occurrence in Laravel CVEs (7% of total)
CWE-611 ⓘ
1
CWE-434
Unrestricted File Upload
1 occurrence in Laravel CVEs (7% of total)
CWE-434 ⓘ
1
CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
Unknown Weakness Type
1 occurrence in Laravel CVEs (7% of total)
CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) ⓘ
1
CWE-502
Deserialization of Untrusted Data
1 occurrence in Laravel CVEs (7% of total)
CWE-502 ⓘ
1
▸Company Profile

Laravel is an open-source PHP web framework created by Taylor Otwell, designed for building modern web applications with an expressive, elegant syntax. It is one of the most popular PHP frameworks globally, widely used for its robust ecosystem including tools like Laravel Forge, Vapor, and Nova. From a cybersecurity perspective, Laravel's security features (e.g., CSRF protection, encryption, and authentication) and its large community make it a frequent target for vulnerability research, with 15 CVEs tracked.

▸Response Metrics
Est. MTTR ⓘ ~193 days (Poor)
Mean Time To Remediate. Estimates days from CVE disclosure to patch.
Industry avg: ~60d (good) · 100-300d (poor) · 300d+ (critical)
CVE Trend ⓘ ↘ -20% better
CVE count 2026 vs 2025:  5 → 4 CVEs
Patch Speed ⓘ Poor (>65% open)
13% of CVEs still unpatched.  Excellent: <20% · Good: 20-40% · Avg: 40-65% · Poor: >65%
▸ Financial Risk Estimate
Est. GDPR Low
€610K
Est. GDPR High
€6.1M

Based on 1 critical CVEs, 0 CISA KEV, 100% unpatched. Model: GDPR Art.83 · not legal advice.

▸Actions
⚖ Compare with another vendor
▸Embed Badge
Laravel D valtersit.com