{ "@id": "urn:uuid:c0068c4c-ec1c-401c-98c8-a91769abb96e", "role": "Document Creator", "author": "https://tuxcare.com", "version": 17, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-29T00:51:30.888148+00:00", "statements": [ { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 11.51.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 11.51.0-p1+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel framework version 11.51.0-p4+tuxcare) is NOT AFFECTED by CVE-2017-14775. The vulnerability concerned Laravel versions before 5.5.10 where DatabaseUserProvider and EloquentUserProvider performed variable-time token comparison using database WHERE clauses, allowing timing attacks on remember_me tokens. The fix (constant-time comparison using hash_equals()) was intro...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target repository (Laravel framework version 11.51.0-p4+tuxcare) is NOT AFFECTED by CVE-2017-14775. The vulnerability concerned Laravel versions before 5.5.10 where DatabaseUserProvider and EloquentUserProvider performed variable-time token comparison using database WHERE clauses, allowing timing attacks on remember_me tokens. The fix (constant-time comparison using hash_equals()) was intro..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 11.51.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 11.51.0-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 11.51.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 11.51.0-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 11.51.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 11.51.0-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 11.51.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 11.51.0-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 11.51.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 11.51.0-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 11.51.0-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework 11.51.0-p4+tuxcare is NOT affected by CVE-2021-43808. The vulnerability involved predictable parent placeholder hashes in Blade templates enabling XSS attacks by allowing attackers to guess placeholder tokens like ##parent-placeholder-## and inject malicious content. The fix (random salt-based hashing + runtime evaluation) was already present in upstream Laravel 11.51.0 ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel Framework 11.51.0-p4+tuxcare is NOT affected by CVE-2021-43808. The vulnerability involved predictable parent placeholder hashes in Blade templates enabling XSS attacks by allowing attackers to guess placeholder tokens like ##parent-placeholder-## and inject malicious content. The fix (random salt-based hashing + runtime evaluation) was already present in upstream Laravel 11.51.0 ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 11.51.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 11.51.0-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T22:05:48.947173+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 11.51.0-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 11.51.0-p4+tuxcare is NOT AFFECTED by CVE-2025-27515. The vulnerability (wildcard validation bypass allowing user-crafted array keys to bypass validation rules) was fixed in the upstream Laravel v11.51.0 release before TuxCare onboarded this version. The fix is present in the target at src/Illuminate/Validation/Validator.php lines 875-921, where the validateUsingCustomRule me...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 The target Laravel 11.51.0-p4+tuxcare is NOT AFFECTED by CVE-2025-27515. The vulnerability (wildcard validation bypass allowing user-crafted array keys to bypass validation rules) was fixed in the upstream Laravel v11.51.0 release before TuxCare onboarded this version. The fix is present in the target at src/Illuminate/Validation/Validator.php lines 875-921, where the validateUsingCustomRule me..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:33:09.068963+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 11.51.0-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-102279. The vulnerability was introduced in Laravel 12.x with a redesigned exception renderer that explicitly set `allowHTML: true` in Tippy.js tooltip configuration. Laravel 11.x uses a different exception renderer architecture that never had this vulnerable pattern. While 11.x does display attacker-controlled data (request headers, route context) in...", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-102279. The vulnerability was introduced in Laravel 12.x with a redesigned exception renderer that explicitly set `allowHTML: true` in Tippy.js tooltip configuration. Laravel 11.x uses a different exception renderer architecture that never had this vulnerable pattern. While 11.x does display attacker-controlled data (request headers, route context) in..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 11.51.0-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-114508. The vulnerable JSON:API resource feature was introduced in Laravel 12.45.0 (December 2025) and does not exist in this version. The entire JsonApi component, including the vulnerable ResolvesJsonApiElements trait that allowed malicious include parameters to trigger destructive database operations like truncate(), is not present in v11.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-114508. The vulnerable JSON:API resource feature was introduced in Laravel 12.45.0 (December 2025) and does not exist in this version. The entire JsonApi component, including the vulnerable ResolvesJsonApiElements trait that allowed malicious include parameters to trigger destructive database operations like truncate(), is not present in v11.x." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T13:21:38.472678+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 11.51.0-p1+tuxcare of laravel/framework, and is fixed in 11.51.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 11.51.0-p1+tuxcare of laravel/framework, and is fixed in 11.51.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 11.51.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "action_statement": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 11.51.0-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 11.51.0-p1+tuxcare of laravel/framework, and is fixed in 11.51.0-p2+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 11.51.0-p1+tuxcare of laravel/framework, and is fixed in 11.51.0-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:02:32.915814+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 11.51.0-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v11.51.0 is NOT affected by GHSA-6jvx-8ch9-j2jr. The vulnerability concerned PHP object deserialization in cookies, which was fixed upstream in Laravel 5.6.30 (August 2018) by disabling serialization for all cookies. Version 11.51.0 (released ~2024) is much newer and inherited this fix from the upstream release. The vulnerable code pattern (cookies encrypted/decrypt...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 The target Laravel framework v11.51.0 is NOT affected by GHSA-6jvx-8ch9-j2jr. The vulnerability concerned PHP object deserialization in cookies, which was fixed upstream in Laravel 5.6.30 (August 2018) by disabling serialization for all cookies. Version 11.51.0 (released ~2024) is much newer and inherited this fix from the upstream release. The vulnerable code pattern (cookies encrypted/decrypt..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 11.51.0-p1+tuxcare of laravel/framework. not_affected \u2014 The IV length validation fix for GHSA-7852-w36x-6mf6 is already present in Laravel 11.51.0. The vulnerability was fixed in upstream Laravel in March 2018 (commit 886d261df0 by Taylor Otwell). The fix validates that the base64-decoded IV length matches the expected cipher IV length before decryption, preventing silent failures that could lead to weak type comparison bypasses (false == ''). TuxCa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The IV length validation fix for GHSA-7852-w36x-6mf6 is already present in Laravel 11.51.0. The vulnerability was fixed in upstream Laravel in March 2018 (commit 886d261df0 by Taylor Otwell). The fix validates that the base64-decoded IV length matches the expected cipher IV length before decryption, preventing silent failures that could lead to weak type comparison bypasses (false == ''). TuxCa..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp affects version 11.51.0-p1+tuxcare of laravel/framework, and is fixed in 11.51.0-p2+tuxcare.", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "action_statement": "Vulnerability GHSA-crmm-hgp2-wgrp affects version 11.51.0-p1+tuxcare of laravel/framework, and is fixed in 11.51.0-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:17:24.242406+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 11.51.0-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework 11.51.0-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability pattern (unexpected query bindings from array parameters in scalar contexts) is not present because the fix was already included in the upstream Laravel v11.51.0 release. The target contains a `flattenValue()` method (line 4217) that flattens arrays to scalar values before binding, and all ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework 11.51.0-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability pattern (unexpected query bindings from array parameters in scalar contexts) is not present because the fix was already included in the upstream Laravel v11.51.0 release. The target contains a `flattenValue()` method (line 4217) that flattens arrays to scalar values before binding, and all ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 11.51.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 11.51.0-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 11.51.0-p1+tuxcare of laravel/framework. not_affected \u2014 Target version 11.51.0 is NOT vulnerable to GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was fixed in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April 2021) by adding integer casting to limit and offset parameters. Laravel 11.51.0 (released 2024) inherits these fixes from the upstream codebase. Both critical files (SqlServerGrammar.php and Builder.php) conta...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Target version 11.51.0 is NOT vulnerable to GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was fixed in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April 2021) by adding integer casting to limit and offset parameters. Laravel 11.51.0 (released 2024) inherits these fixes from the upstream codebase. Both critical files (SqlServerGrammar.php and Builder.php) conta..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 11.51.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 11.51.0-p1+tuxcare of laravel/framework." } ] }