{ "@id": "urn:uuid:cf997737-e949-4097-b3e5-319da4f18640", "role": "Document Creator", "author": "https://tuxcare.com", "version": 18, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-29T00:51:30.888148+00:00", "statements": [ { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 10.50.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 10.50.2-p1+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 affects Laravel before version 5.5.10 due to timing-attack vulnerability in remember-me token verification. The target repository contains Laravel 10.50.2, which is approximately 7 years newer than the fixed version. The fix (constant-time token comparison using hash_equals) was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. Both DatabaseUserProvi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 affects Laravel before version 5.5.10 due to timing-attack vulnerability in remember-me token verification. The target repository contains Laravel 10.50.2, which is approximately 7 years newer than the fixed version. The fix (constant-time token comparison using hash_equals) was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. Both DatabaseUserProvi..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 10.50.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 10.50.2-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 10.50.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 10.50.2-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 10.50.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 10.50.2-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 10.50.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 10.50.2-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 10.50.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 10.50.2-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 10.50.2-p1+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 (Blade XSS via predictable parent placeholder) is NOT present in Laravel 10.50.2. The vulnerability was fixed upstream in December 2021 (Laravel 6.x/7.x/8.x), and the fix was already included when Laravel 10.x was released in February 2023. The target code shows all three components of the security fix: (1) ManagesLayouts.php generates parent placeholders using a random 40-charac...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 (Blade XSS via predictable parent placeholder) is NOT present in Laravel 10.50.2. The vulnerability was fixed upstream in December 2021 (Laravel 6.x/7.x/8.x), and the fix was already included when Laravel 10.x was released in February 2023. The target code shows all three components of the security fix: (1) ManagesLayouts.php generates parent placeholders using a random 40-charac..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 10.50.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 10.50.2-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T22:05:48.947173+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 10.50.2-p1+tuxcare of laravel/framework. not_affected \u2014 The target repository (laravel/framework 10.50.2-p4+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. The fix modifies the Validator class to preserve internal placeholder encoding when passing attribute names to File/Email/Password custom rules, preventing attackers from bypassing wildcard valid...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 The target repository (laravel/framework 10.50.2-p4+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. The fix modifies the Validator class to preserve internal placeholder encoding when passing attribute names to File/Email/Password custom rules, preventing attackers from bypassing wildcard valid..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:33:09.068963+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 10.50.2-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.50.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's new exception renderer feature that uses Tippy.js tooltips with allowHTML:true. Laravel 10.x uses a completely different exception handling system (Whoops library) and does not contain the vulnerable code pattern. The exception renderer with Tippy.js was introduced in Laravel 12.x and does not exist i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 10.50.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's new exception renderer feature that uses Tippy.js tooltips with allowHTML:true. Laravel 10.x uses a completely different exception handling system (Whoops library) and does not contain the vulnerable code pattern. The exception renderer with Tippy.js was introduced in Laravel 12.x and does not exist i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 10.50.2-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework 10.50.2-p4+tuxcare is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in the JsonApi resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 12.x (December 2025). Laravel 10.x does not contain any JsonApi resource functionality. Exhaustive searches across all 2522 files in the repository found no JsonApi-related co...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 The target Laravel Framework 10.50.2-p4+tuxcare is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in the JsonApi resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 12.x (December 2025). Laravel 10.x does not contain any JsonApi resource functionality. Exhaustive searches across all 2522 files in the repository found no JsonApi-related co..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T15:16:50.127733+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 10.50.2-p1+tuxcare of laravel/framework, and is fixed in 10.50.2-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 10.50.2-p1+tuxcare of laravel/framework, and is fixed in 10.50.2-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:46:45.854078+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 10.50.2-p1+tuxcare of laravel/framework. not_affected \u2014 The target (Laravel 10.50.2-p4+tuxcare) is NOT AFFECTED by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input to limit/offset/skip/take functions on SQL Server. The fix (integer casting) was already present in upstream Laravel 10.50.2 when TuxCare onboarded it on 2026-05-05. Defense exists at two layers: (1) Builder methods cast inputs via (int) before stor...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 The target (Laravel 10.50.2-p4+tuxcare) is NOT AFFECTED by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input to limit/offset/skip/take functions on SQL Server. The fix (integer casting) was already present in upstream Laravel 10.50.2 when TuxCare onboarded it on 2026-05-05. Defense exists at two layers: (1) Builder methods cast inputs via (int) before stor..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 10.50.2-p1+tuxcare of laravel/framework, and is fixed in 10.50.2-p3+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 10.50.2-p1+tuxcare of laravel/framework, and is fixed in 10.50.2-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:02:56.515055+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 10.50.2-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.50.2-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling serialization for cookies. Laravel 10.50.2 inherits this fix from upstream with a static $serialize = false property that prevents all cookie serialization. The vulnerable pattern (serialization enabled by default) is...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 10.50.2-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling serialization for cookies. Laravel 10.50.2 inherits this fix from upstream with a static $serialize = false property that prevents all cookie serialization. The vulnerable pattern (serialization enabled by default) is..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 10.50.2-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework 10.50.2 is NOT AFFECTED by GHSA-7852-w36x-6mf6 (Encrypter IV length validation vulnerability). The fix for this vulnerability was already present in the upstream Laravel 10.50.2 release when TuxCare onboarded it. The vulnerable code pattern (missing IV length validation in validPayload method) is not present in the current HEAD. The defense validates that the base64...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework 10.50.2 is NOT AFFECTED by GHSA-7852-w36x-6mf6 (Encrypter IV length validation vulnerability). The fix for this vulnerability was already present in the upstream Laravel 10.50.2 release when TuxCare onboarded it. The vulnerable code pattern (missing IV length validation in validPayload method) is not present in the current HEAD. The defense validates that the base64..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 10.50.2-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.50.2 does not contain the vulnerable local filesystem temporary signed URL feature. The LocalFilesystemAdapter class and its associated temporaryUrl()/temporaryUploadUrl() methods were introduced in Laravel 11.x. The vulnerable code path does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 10.50.2 does not contain the vulnerable local filesystem temporary signed URL feature. The LocalFilesystemAdapter class and its associated temporaryUrl()/temporaryUploadUrl() methods were introduced in Laravel 11.x. The vulnerable code path does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:19:00.657885+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 10.50.2-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 10.50.2-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability involves crafting HTTP request parameters as arrays (including nested arrays) where scalar values are expected, causing unexpected SQL query bindings. The fix (flattenValue method using Arr::flatten()) was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. All vulnerable ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel 10.50.2-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability involves crafting HTTP request parameters as arrays (including nested arrays) where scalar values are expected, causing unexpected SQL query bindings. The fix (flattenValue method using Arr::flatten()) was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. All vulnerable ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 10.50.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 10.50.2-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 10.50.2-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 10.50.2-p4+tuxcare is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). All required integer casting defenses are present in the codebase. The fix was already included in the upstream Laravel 10.50.2 release that TuxCare onboarded, prior to any TuxCare modifications. The vulnerable pattern (unvalidated user input in limit/offset parameters reaching ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target Laravel 10.50.2-p4+tuxcare is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). All required integer casting defenses are present in the codebase. The fix was already included in the upstream Laravel 10.50.2 release that TuxCare onboarded, prior to any TuxCare modifications. The vulnerable pattern (unvalidated user input in limit/offset parameters reaching ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 10.50.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 10.50.2-p1+tuxcare of laravel/framework." } ] }