{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e0d29e28-d38f-5c24-ba14-5c70b2b206e2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "type": "library", "group": "laravel", "bom-ref": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "version": "10.48.28-p3+tuxcare", "pedigree": { "ancestors": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@10.48.28", "type": "library", "group": "laravel", "version": "10.48.28" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-14775", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } ], "bom-ref": "urn:uuid:1520be2c-9cd7-5729-a9f8-6f56544ca202", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-14775 does not affect version 10.48.28-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28 is not affected by CVE-2017-14775. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel v5.5.10 (September 2017) by introducing hash_equals() for constant-time comparison. The target version 10.48.28 inherited this fix from upstream - both DatabaseUserProvider and EloquentUserProvider use hash_equals() for token verification. The fix was autho...", "justification": "code_not_present" } }, { "id": "CVE-2018-15133", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } ], "bom-ref": "urn:uuid:7b616630-a446-537d-9c04-5bbf3fe30dd4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15133 affects version 10.48.28-p3+tuxcare of laravel/framework." } }, { "id": "CVE-2019-9081", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } ], "bom-ref": "urn:uuid:7396546b-3460-58bb-b12c-576f9d10f612", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-9081 affects version 10.48.28-p3+tuxcare of laravel/framework." } }, { "id": "CVE-2020-19316", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } ], "bom-ref": "urn:uuid:191b51fb-e694-57b9-bc0a-e91cd6fceaff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-19316 affects version 10.48.28-p3+tuxcare of laravel/framework." } }, { "id": "CVE-2020-24941", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } ], "bom-ref": "urn:uuid:428e005b-fbff-510c-a0dc-27edf6c02779", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-24941 affects version 10.48.28-p3+tuxcare of laravel/framework." } }, { "id": "CVE-2021-21263", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } ], "bom-ref": "urn:uuid:12ec6b3c-b013-59f1-bad9-434fe992b67d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-21263 affects version 10.48.28-p3+tuxcare of laravel/framework." } }, { "id": "CVE-2021-43808", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } ], "bom-ref": "urn:uuid:d6a36551-7053-5e9c-8934-113175cd8f3b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-43808 does not affect version 10.48.28-p3+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 (Blade XSS via predictable parent placeholder) is not present in the target. The security fix was already included in upstream Laravel 10.48.28, which TuxCare onboarded. The target implements all three security components: random salt generation (using cryptographically secure random_bytes()), runtime placeholder computation, and cache-busting 'v2' prefix. The vulnerability was o...", "justification": "code_not_present" } }, { "id": "CVE-2024-52301", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } ], "bom-ref": "urn:uuid:3ff4a4c2-65b1-504d-aca3-a0039f55afbd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52301 affects version 10.48.28-p3+tuxcare of laravel/framework." } }, { "id": "CVE-2025-27515", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } ], "bom-ref": "urn:uuid:e2f0c111-9204-5a96-a03f-a9f5bf076056", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27515 is fixed in version 10.48.28-p3+tuxcare of laravel/framework." } }, { "id": "CVE-2026-102279", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } ], "bom-ref": "urn:uuid:a0674649-b256-5bf5-8e71-f2dd3f1f575f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-102279 does not affect version 10.48.28-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28 is not affected by CVE-2026-102279. The vulnerability targets Laravel's custom exception renderer with Tippy.js tooltips, which was introduced in Laravel 12.x. Laravel 10.x uses a completely different exception rendering architecture (Whoops PrettyPageHandler and Symfony HtmlErrorRenderer) that does not include JavaScript tooltips or the vulnerable allowHTML:true configuration....", "justification": "code_not_present" } }, { "id": "CVE-2026-114508", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } ], "bom-ref": "urn:uuid:cacca3a2-5e00-5c38-a5c5-4986e9d84bad", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114508 does not affect version 10.48.28-p3+tuxcare of laravel/framework. not_affected \u2014 The target version (laravel/framework 10.48.28) is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resources feature, which was introduced in version 12.x (December 2025). Version 10.48.28 predates this feature entirely - the vulnerable code (ResolvesJsonApiElements trait) and the entire JsonApi module do not exist in v10.x. The target uses standard JSON resource...", "justification": "code_not_present" } }, { "id": "CVE-2026-114509", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } ], "bom-ref": "urn:uuid:ac895f4f-05de-522c-9213-885d7cca2835", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-114509 is fixed in version 10.48.28-p3+tuxcare of laravel/framework." } }, { "id": "GHSA-4mg9-vhxq-vm7j", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } ], "bom-ref": "urn:uuid:d303bda2-2f17-525e-a76c-5614750c55f9", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 10.48.28-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework v10.48.28-p3+tuxcare is not affected by GHSA-4mg9-vhxq-vm7j (SQL Server limit/offset SQL injection). The vulnerability pattern is absent because the upstream fix was already included in Laravel v10.48.28, which was onboarded into the TuxCare branch. Integer casting protections are present in both Builder.php (limit/offset/skip/take methods) and SqlServerGrammar.php ...", "justification": "code_not_present" } }, { "id": "GHSA-5vg9-5847-vvmq", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } ], "bom-ref": "urn:uuid:8a5c290f-8e90-56fd-93d6-932ab3bedf22", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 10.48.28-p3+tuxcare of laravel/framework." } }, { "id": "GHSA-6jvx-8ch9-j2jr", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } ], "bom-ref": "urn:uuid:6a7f67e2-1916-558a-86b2-7542119e09d6", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 10.48.28-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28-p3+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie deserialization). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling automatic serialization for all cookies. Laravel 10.48.28 was released in 2024, approximately 6 years after the fix, and the protection was already present in the upstream release that TuxCare onboarded. Th...", "justification": "code_not_present" } }, { "id": "GHSA-7852-w36x-6mf6", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } ], "bom-ref": "urn:uuid:ef7cd40b-b3b9-54d3-81cd-72270c7c3123", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-7852-w36x-6mf6 affects version 10.48.28-p3+tuxcare of laravel/framework." } }, { "id": "GHSA-crmm-hgp2-wgrp", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } ], "bom-ref": "urn:uuid:1533d27f-395c-57a4-bc65-5cd40f73bf2c", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 10.48.28-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28 does not contain the vulnerable code path. The vulnerability (GHSA-crmm-hgp2-wgrp) affects Laravel 11+'s LocalFilesystemAdapter class, which was introduced in Laravel 11 and does not exist in Laravel 10. Laravel 10 uses a delegating architecture where FilesystemAdapter throws RuntimeException for local filesystem temporary URLs rather than implementing them.", "justification": "code_not_present" } }, { "id": "GHSA-jwvj-pwww-3mj5", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } ], "bom-ref": "urn:uuid:249e3cf1-9ad7-58a8-8742-2a54e0df66c1", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 10.48.28-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel framework 10.48.28 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerable pattern described in the advisory (unexpected query bindings when array values are passed where scalars are expected) is not present in this version. The upstream Laravel 10.48.28 release already included the complete fix, which normalizes array inputs to scalar values using the `flattenValue()` helper method and ...", "justification": "code_not_present" } }, { "id": "GHSA-qm5c-m76r-2hfr", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } ], "bom-ref": "urn:uuid:013692c1-b2ad-5172-adbf-457ffcdcd8b8", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 10.48.28-p3+tuxcare of laravel/framework." } }, { "id": "GHSA-wq8p-mqvg-2p5h", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } ], "bom-ref": "urn:uuid:a71240f5-3b66-5c5d-8eae-23b6bde0dab9", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 10.48.28-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched by upstream Laravel in April 2021 (versions 6.20.26, 7.30.5, 8.40.0). Laravel 10.48.28, released in 2024, already contains all required integer casting defenses in SqlServerGrammar.php (is_numeric checks, int casts in compileColumns/compileLimit/compileOffset) and Build...", "justification": "code_not_present" } }, { "id": "GHSA-x7p5-p2c9-phvg", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } ], "bom-ref": "urn:uuid:3644cca3-6bd0-57bf-96a4-186a358ed0ea", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 10.48.28-p3+tuxcare of laravel/framework." } } ], "dependencies": [ { "ref": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } ] }