{ "@id": "urn:uuid:6534e665-0932-44fe-892e-4fc03cc49476", "role": "Document Creator", "author": "https://tuxcare.com", "version": 15, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-29T00:51:30.888148+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 11.44.0-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is not affected by CVE-2017-14775. The vulnerability was fixed in Laravel 5.5.10 (September 2017) by replacing database-level token comparison with constant-time hash_equals() comparison. The target version 11.44.0 already contains this fix as it was present in the upstream release when TuxCare onboarded it. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() fo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is not affected by CVE-2017-14775. The vulnerability was fixed in Laravel 5.5.10 (September 2017) by replacing database-level token comparison with constant-time hash_equals() comparison. The target version 11.44.0 already contains this fix as it was present in the upstream release when TuxCare onboarded it. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() fo..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 11.44.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 11.44.0-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 11.44.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 11.44.0-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 11.44.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 11.44.0-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 11.44.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 11.44.0-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 11.44.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 11.44.0-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:25:11.687376+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 11.44.0-p3+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 (XSS via predictable Blade parent placeholders) is not present in Laravel 11.44.0. The vulnerability pattern (deterministic sha1($section) hashes allowing placeholder prediction) was fixed by upstream Laravel in December 2021. The fix was already included in the v11.44.0 release before TuxCare onboarded it. Both critical files contain the defense: ManagesLayouts.php uses per-requ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 (XSS via predictable Blade parent placeholders) is not present in Laravel 11.44.0. The vulnerability pattern (deterministic sha1($section) hashes allowing placeholder prediction) was fixed by upstream Laravel in December 2021. The fix was already included in the v11.44.0 release before TuxCare onboarded it. Both critical files contain the defense: ManagesLayouts.php uses per-requ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 11.44.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 11.44.0-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-13T11:50:05.169855+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 11.44.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-13T11:50:05.169855+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 11.44.0-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is NOT affected by CVE-2026-102279. The vulnerability (DOM-based XSS via Tippy.js tooltips with allowHTML: true) was introduced in Laravel 12.x and never existed in version 11.x. The target uses Tippy.js v6.3.7 without setting allowHTML, relying on the library's safe default (allowHTML: false), which prevents HTML interpretation in tooltips. Although attacker-controlled input (H...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is NOT affected by CVE-2026-102279. The vulnerability (DOM-based XSS via Tippy.js tooltips with allowHTML: true) was introduced in Laravel 12.x and never existed in version 11.x. The target uses Tippy.js v6.3.7 without setting allowHTML, relying on the library's safe default (allowHTML: false), which prevents HTML interpretation in tooltips. Although attacker-controlled input (H..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 11.44.0-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource feature, which was introduced in Laravel 12.x (commit 2f30936319, first appearing in v12.45.0). The target version (11.44.0) predates the JsonApi feature entirely. The vulnerable code path - specifically the ResolvesJsonApiElements trait that processes relationship include parameters and c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource feature, which was introduced in Laravel 12.x (commit 2f30936319, first appearing in v12.45.0). The target version (11.44.0) predates the JsonApi feature entirely. The vulnerable code path - specifically the ResolvesJsonApiElements trait that processes relationship include parameters and c..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-27T09:58:59.407356+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 11.44.0-p3+tuxcare of laravel/framework, and is fixed in 11.44.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 11.44.0-p3+tuxcare of laravel/framework, and is fixed in 11.44.0-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-13T11:50:05.169855+00:00", "status_notes": "Vulnerability CVE-2026-24765 does not affect version 11.44.0-p3+tuxcare of laravel/framework. CVE-2026-24765 pertains to phpunit, not laravel/framework. Tracked on the phpunit VPV.", "vulnerability": { "name": "CVE-2026-24765" }, "impact_statement": "CVE-2026-24765 pertains to phpunit, not laravel/framework. Tracked on the phpunit VPV." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T20:46:42.693041+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 11.44.0-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 11.44.0 is NOT affected by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input passed to limit/offset/skip/take functions when using SQL Server. The fix was authored by Taylor Otwell (upstream) in commit 09bf1457e9 (April 28, 2021) and was already present in the upstream Laravel 11.44.0 release before TuxCare onboarding. The fix adds integ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 The target Laravel 11.44.0 is NOT affected by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input passed to limit/offset/skip/take functions when using SQL Server. The fix was authored by Taylor Otwell (upstream) in commit 09bf1457e9 (April 28, 2021) and was already present in the upstream Laravel 11.44.0 release before TuxCare onboarding. The fix adds integ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-13T11:50:05.169855+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 11.44.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T20:58:31.605031+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 11.44.0-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization RCE vulnerability). The security fix that disables cookie serialization was introduced by upstream Laravel in v5.6.30 (August 2018) and is fully present in the target version. The vulnerable pattern (automatic PHP object serialization/unserialization of encrypted cookies) has been removed. Cookie serialization is dis...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization RCE vulnerability). The security fix that disables cookie serialization was introduced by upstream Laravel in v5.6.30 (August 2018) and is fully present in the target version. The vulnerable pattern (automatic PHP object serialization/unserialization of encrypted cookies) has been removed. Cookie serialization is dis..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 11.44.0-p3+tuxcare of laravel/framework. not_affected \u2014 GHSA-7852-w36x-6mf6 is NOT present in laravel/framework 11.44.0-p4+tuxcare. The vulnerability was fixed upstream by Taylor Otwell on March 30, 2018 (commit 886d261df0), seven years before TuxCare onboarded this version in October 2025. The fix adds IV length validation in the Encrypter::validPayload() method at line 273, preventing manipulated encrypted payloads from causing silent decryption f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 GHSA-7852-w36x-6mf6 is NOT present in laravel/framework 11.44.0-p4+tuxcare. The vulnerability was fixed upstream by Taylor Otwell on March 30, 2018 (commit 886d261df0), seven years before TuxCare onboarded this version in October 2025. The fix adds IV length validation in the Encrypter::validPayload() method at line 273, preventing manipulated encrypted payloads from causing silent decryption f..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-13T11:50:05.169855+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp is fixed in version 11.44.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:15:38.790655+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 11.44.0-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v11.44.0 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability requires array values to bypass flattening before being added to query bindings. The target already contains the fix: all vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use flattenValue() or equivalent Arr::flatt...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework v11.44.0 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability requires array values to bypass flattening before being added to query bindings. The target already contains the fix: all vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use flattenValue() or equivalent Arr::flatt..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 11.44.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 11.44.0-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 11.44.0-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework 11.44.0 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was patched in Laravel 6.20.26, 7.30.5, and 8.40.0 in April 2021. Version 11.44.0 already contains the complete upstream fix with comprehensive integer casting protections in both the Query Builder and SQL Server Grammar classes. The fix was present in the upstream v11.44....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Laravel Framework 11.44.0 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was patched in Laravel 6.20.26, 7.30.5, and 8.40.0 in April 2021. Version 11.44.0 already contains the complete upstream fix with comprehensive integer casting protections in both the Query Builder and SQL Server Grammar classes. The fix was present in the upstream v11.44...." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 11.44.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 11.44.0-p3+tuxcare of laravel/framework." } ] }