Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 08:05 UTC

Critical in the last 24 hours

1601 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

181-70% vs 7-day avg of 598

2 critical, 65 high, 73 medium, 31 low

Expand	Severity	Score	Advisory	Title	Source	Published
	Critical	9.2	CVE-2026-114509	Laravel is a web application framework laravellaravel framework, Laravel	NVD	Oct 21 22:16 UTC
CVE-2026-114509Laravel is a web application framework Executive summary The advisory describes a fix in the Laravel web application framework's token authentication guard. The advisory's text does not state how serious the flaw is or whether it has been exploited, and it does not give a severity score. The available text shows a code change that stops the token guard from accepting non-string token values. Technical summary The change in TokenGuard.php adds type checks so that the user() and validate() methods only process tokens that are strings, and it adds tests that send an array-valued api_token. The vulnerability class is not stated, though the change suggests improper input type handling in token authentication. The advisory does not state the attack vector, preconditions, affected versions, or fixed versions in the text provided. No workaround or detection guidance is stated. Exploitation in the wild and a CVSS score are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/laravel/framework/commit/8db…4a9d259a419620f1e8a5 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects laravel laravel framework Laravel NIST National Vulnerability DatabasePublished Oct 21, 2026 22:16 UTC Read the advisory
	Medium	6.5	CVE-2026-114508	Laravel is a web application framework laravellaravel framework, Laravel	NVD	Oct 21 22:16 UTC
CVE-2026-114508Laravel is a web application framework Executive summary The advisory is a code diff for the Laravel web application framework, a fix to how JSON:API resource relationships are handled. The advisory text does not describe the impact, severity, or whether the change is a security fix, and it does not state a CVSS score. It does not give a vendor recommendation beyond the code change itself. Technical summary The diff changes the JSON:API resource relationship compilation in Laravel's Illuminate Http Resources JsonApi code, replacing the nested include map logic with a requestedResourceRelationships helper. A new test named testItIgnoresNestedIncludesThatAreNotResourceRelationships exercises include values such as comments.truncate, and a second test exercises posts.comments.truncate, which suggests that non-relationship nested include names were previously processed. The advisory does not name a vulnerability class, CWE, attack vector, or required privileges. Affected versions, fixed versions, workarounds, and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/laravel/framework/commit/50a…4f1e949de2abaaf4263e Impact if exploited ConfidentialityNone IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L Affects laravel laravel framework Laravel NIST National Vulnerability DatabasePublished Oct 21, 2026 22:16 UTC Read the advisory
	Low	3.1	CVE-2026-102279	Laravel is a web application framework laravellaravel framework	NVD	Sep 28 21:17 UTC
CVE-2026-102279Laravel is a web application framework From the advisory Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is fixed in versions 12.69.0 and 13.30.0. Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N Affects laravel laravel framework NIST National Vulnerability DatabasePublished Sep 28, 2026 21:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

Search syntax

Welcome to CVEsee.org

What is CVEsee.org?

Disclaimer

You are leaving CVEsee.org

Install CVEsee