Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 08:05 UTC

Critical in the last 24 hours

1601 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

181-70% vs 7-day avg of 598

2 critical, 65 high, 73 medium, 31 low

Expand	Severity	Score	Advisory	Title	Source	Published
	Low	2.1	CVE-2026-116224	A vulnerability has been found in fr0tt benotes up to 2.8.1 laravel, fr0ttLaravel, fr0tt benotes	NVD	Oct 26 07:17 UTC
CVE-2026-116224A vulnerability has been found in fr0tt benotes up to 2.8.1 Executive summary A server-side request forgery flaw has been reported in fr0tt benotes version 2.8.1 and earlier. Any logged-in user can make the server fetch internal addresses and read parts of the responses, which may expose internal content. The advisory gives a CVSS 3.1 base score of 4.3 (Medium) and does not state a vendor-issued fix or recommendation beyond the remediation steps the researcher proposes. Technical summary The flaw is CWE-918 server-side request forgery in the GET /api/meta endpoint, which requires an authenticated account; the advisory states accounts are created by an admin and there is no public self-registration. The URL is validated only with Laravel's url rule, which accepts any scheme, and is then fetched with curl_exec with CURLOPT_FOLLOWLOCATION enabled and no private-address or redirect checks. The advisory shows loopback fetches, redirect following, and file:// URLs reaching libcurl, with partial title and description read-back in JSON. Affected version is stated as 2.8.1 (master branch, commit cb803b32340eb7720131a9d0b93261d01800c896), and the phrase 'up to 2.8.1' appears in the advisory. No fixed version, vendor patch, or exploitation in the wild is stated. Proposed remediation is a http/https allow-list, IP range blocking with IP pinning, redirect re-validation or disabling follow-redirects, and the same policy for the Chrome crawler. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from gist.github.com/qianqiusujiu/58f979be4c…bd1cf2864d85e79603d8 Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects laravel fr0tt Laravel fr0tt benotes NIST National Vulnerability DatabasePublished Oct 26, 2026 07:17 UTC Read the advisory
	Critical	9.2	CVE-2026-114509	Laravel is a web application framework laravellaravel framework, Laravel	NVD	Oct 21 22:16 UTC
CVE-2026-114509Laravel is a web application framework Executive summary The advisory describes a fix in the Laravel web application framework's token authentication guard. The advisory's text does not state how serious the flaw is or whether it has been exploited, and it does not give a severity score. The available text shows a code change that stops the token guard from accepting non-string token values. Technical summary The change in TokenGuard.php adds type checks so that the user() and validate() methods only process tokens that are strings, and it adds tests that send an array-valued api_token. The vulnerability class is not stated, though the change suggests improper input type handling in token authentication. The advisory does not state the attack vector, preconditions, affected versions, or fixed versions in the text provided. No workaround or detection guidance is stated. Exploitation in the wild and a CVSS score are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/laravel/framework/commit/8db…4a9d259a419620f1e8a5 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects laravel laravel framework Laravel NIST National Vulnerability DatabasePublished Oct 21, 2026 22:16 UTC Read the advisory
	Medium	6.5	CVE-2026-114508	Laravel is a web application framework laravellaravel framework, Laravel	NVD	Oct 21 22:16 UTC
CVE-2026-114508Laravel is a web application framework Executive summary The advisory is a code diff for the Laravel web application framework, a fix to how JSON:API resource relationships are handled. The advisory text does not describe the impact, severity, or whether the change is a security fix, and it does not state a CVSS score. It does not give a vendor recommendation beyond the code change itself. Technical summary The diff changes the JSON:API resource relationship compilation in Laravel's Illuminate Http Resources JsonApi code, replacing the nested include map logic with a requestedResourceRelationships helper. A new test named testItIgnoresNestedIncludesThatAreNotResourceRelationships exercises include values such as comments.truncate, and a second test exercises posts.comments.truncate, which suggests that non-relationship nested include names were previously processed. The advisory does not name a vulnerability class, CWE, attack vector, or required privileges. Affected versions, fixed versions, workarounds, and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/laravel/framework/commit/50a…4f1e949de2abaaf4263e Impact if exploited ConfidentialityNone IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L Affects laravel laravel framework Laravel NIST National Vulnerability DatabasePublished Oct 21, 2026 22:16 UTC Read the advisory
	Low	3.1	CVE-2026-102279	Laravel is a web application framework laravellaravel framework	NVD	Sep 28 21:17 UTC
CVE-2026-102279Laravel is a web application framework From the advisory Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is fixed in versions 12.69.0 and 13.30.0. Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N Affects laravel laravel framework NIST National Vulnerability DatabasePublished Sep 28, 2026 21:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

Search syntax

Welcome to CVEsee.org

What is CVEsee.org?

Disclaimer

You are leaving CVEsee.org

Install CVEsee