laravel/framework (packagist) has 29 known vulnerabilities, the worst rated CRITICAL. No single fixed version is recorded that clears every advisory, so check each one below. No malicious-package signal is recorded.
Laravel's built-in TokenGuard, when configured with a standard token-based API guard, may be bypassed to authenticate as an arbitrary existing user without…
CyberXYZ does not call a package safe in absolute terms. It records 29 known vulnerabilities for laravel/framework (packagist), the worst rated CRITICAL, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does laravel/framework have known vulnerabilities?
Yes. CyberXYZ records 29 known vulnerabilities for laravel/framework (packagist), the worst rated CRITICAL. These include GHSA-f9x3-7vq9-cph6, GHSA-qm5c-m76r-2hfr, GHSA-pfg4-p438-p874, GHSA-5vg9-5847-vvmq, GHSA-gv7v-rgg6-548h.
How do I check laravel/framework before installing?
Search laravel/framework in CyberXYZ Check at https://cyberxyz.io/check?q=laravel%2Fframework. The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 08:15 UTC. The most recent advisory here was published 2026-11-13. Updated continuously from NVD, GHSA, OSV and CNA feeds.