PatchClock

PHP security digest · Packages

laravel/framework security advisories

3 advisories we have followed since September 2026, 1 of them critical or high, newest first. Each page says who is affected, which versions fix it and how to check your project.

  1. Critical 23 Oct 2026

    Laravel TokenGuard authentication bypass through non-string API credentials

    Fixed in 13.29.0, 12.68.0 · CVE-2026-114509

  2. Medium 23 Oct 2026

    Laravel relationship inclusion can trigger unauthorized data destruction

    Fixed in 12.68.0, 13.27.0 · CVE-2026-114508

  3. Low 29 Sep 2026

    Laravel: XSS in Debug Page Information

    Fixed in 12.69.0, 13.30.0 · CVE-2026-102279

Check your project in one command

Composer compares your composer.lock with the public advisory databases:

composer audit

It lists every installed package with a known advisory, including laravel/framework, and the version that fixes it.