CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Laravel Livewire v3 Remote Code Execution (RCE) Vulnerability Urgent Security Advisory (CVE-2025-54068)
[Affected Scope] Laravel Livewire versions v3.0.0 up to and including v3.6.3
[Impact] Unauthenticated remote attackers can exploit the component hydration process to execute arbitrary system commands on the host server
[Mitigation] Immediately upgrade the Livewire package to the patched version v3.6.4 or later
October CMS Account Takeover and Authentication Bypass Vulnerability via Password Reset Flaw (CVE-2021-32648)
[Affected Scope] October CMS versions prior to Build 472 and v1.1.5 (affecting the october/system package)
[Impact] An attacker can bypass authentication and gain full access to any user account, including administrators, by sending a specially crafted password reset request.
[Mitigation] Immediately upgrade October CMS to Build 472, v1.1.5, or a newer version.
Laravel Ignition Debug Mode Remote Code Execution (RCE) Vulnerability Analysis and Mitigation Guide (CVE-2021-3129)
[Affected Scope] Laravel applications running versions prior to 8.4.2 and utilizing facade/ignition versions prior to 2.5.2 with debug mode (APP_DEBUG=true) enabled
[Impact] Unauthenticated remote attackers can execute arbitrary PHP code on the target server, leading to complete system compromise and data exfiltration
[Mitigation] Upgrade the facade/ignition package to version 2.5.2 or higher, and ensure that Laravel debug mode (APP_DEBUG) is set to 'false' in production environments
Laravel Framework Insecure Deserialization Remote Code Execution Vulnerability Analysis and Mitigation Guide (CVE-2018-15133)
[Affected Scope] Laravel Framework versions up to 5.5.40 and 5.6.x versions up to 5.6.29
[Impact] If an attacker obtains or compromises the application key (APP_KEY), they can execute arbitrary remote code (RCE) on the target server by sending a crafted X-XSRF-TOKEN header
[Mitigation] Immediately upgrade the Laravel Framework to the patched versions (5.5.41, 5.6.30, or higher) and rotate the APP_KEY if it has been exposed