tag
Laravel
Critical
Laravel Livewire Remote Code Execution via Known APP_KEY (CVE-2025-54068)
CVE-2025-54068·
Laravel Livewire (versions prior to v3.6.4)
unpatched
Critical
Laravel `files.*` Wildcard Validation Bypass via Polyglot JPEG+PHP Upload (CVE-2025-27515)
CVE-2025-27515·
Laravel Framework (file upload validation using files.* wildcard rules)
unpatched
Critical
Xboard / V2Board — Magic Link Token Leak Unauth Account Takeover (CVE-2026-39912)
CVE-2026-39912·
V2Board / Xboard (VPN/proxy subscription management panels)
unpatched
Medium
TypiCMS Core — Stored XSS via Unsanitized SVG File Upload (CVE-2026-27621)
CVE-2026-27621 (GHSA-xfvg-8v67-j7wp)·
TypiCMS Core (typicms/core)
patched
Critical
Krayin CRM — TinyMCE Upload Unrestricted File Upload to RCE (CVE-2026-38526)
CVE-2026-38526·
Krayin CRM
unpatched
Critical
dedoc/scramble Laravel API-Doc Generator Unauthenticated eval() RCE (CVE-2026-44262)
CVE-2026-44262 / [GHSA-4rm2-28vj-fj39](https://github.com/advisories/GHSA-4rm2-28vj-fj39)·
[dedoc/scramble](https://github.com/dedoc/scramble) — Laravel API documentation generator
unpatched
High
Azuriom CMS Broken Access Control — Account Takeover via AzLink Server Token — CVE-2026-54415
CVE-2026-54415·
Azuriom CMS
patched