Laravel

Microweber CMS Unauthenticated Path Traversal → Arbitrary File Read (CVE-2026-65694) newCVE-2026-65694webHIGH 7.5Patched2026-07-31Laravel Livewire Remote Code Execution via Known APP_KEY (CVE-2025-54068) new KEV EPSS 96%CVE-2025-54068webCRITICAL 9.8Patched2026-07-06Laravel `files.*` Wildcard Validation Bypass via Polyglot JPEG+PHP Upload (CVE-2025-27515) newCVE-2025-27515webCRITICAL 9.8Patched2026-07-06Xboard / V2Board — Magic Link Token Leak Unauth Account Takeover (CVE-2026-39912) newCVE-2026-39912webCRITICAL 9.1Patched2026-07-05TypiCMS Core — Stored XSS via Unsanitized SVG File Upload (CVE-2026-27621) newCVE-2026-27621webMEDIUMPatched2026-07-05Krayin CRM — TinyMCE Upload Unrestricted File Upload to RCE (CVE-2026-38526) newCVE-2026-38526webCRITICALUnverified2026-07-05dedoc/scramble Laravel API-Doc Generator Unauthenticated eval() RCE (CVE-2026-44262) newCVE-2026-44262 / [GHSA-4rm2-28vj-fj39]webCRITICALPatched2026-07-05Azuriom CMS Broken Access Control — Account Takeover via AzLink Server Token — CVE-2026-54415 newCVE-2026-54415webHIGH 3.1Patched2026-07-05