{"schema_version":"1","data":[{"id":53269,"advisory_id":"d8f84176-661c-4ee6-9721-14b08850cead","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114508","source_published_at":"2026-10-21T21:45:31.465+00:00","published_at":"2026-10-25T14:58:36.664403+00:00","extraction_method":"structured","technologies":["core-cve","framework"],"cve_ids":["CVE-2026-114508"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Laravel relationship inclusion can trigger unauthorized data destruction","summary":"Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.","evidence":"cve:CVE-2026-114508","products":[{"name":{"value":"framework","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-114508","aliases":["CVE-2026-114508"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"laravel","product":"framework","versions":[{"status":"affected","version":">= 12.45.0, < 12.68.0"},{"status":"affected","version":">= 13.0.0, < 13.27.0"}]}],"modified":"2026-10-23T21:18:11.415Z","provider":"cve","references":["https://github.com/laravel/framework/security/advisories/GHSA-5wcm-3v2w-8362","https://github.com/laravel/framework/pull/61322","https://github.com/laravel/framework/pull/61323","https://github.com/laravel/framework/commit/50a7970efe9f9990b6ec4f1e949de2abaaf4263e","https://github.com/laravel/framework/commit/b89f2944995d555bfda76dced1ef6c6b04ef17d8","https://github.com/laravel/framework/releases/tag/v12.68.0","https://github.com/laravel/framework/releases/tag/v13.27.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-114508","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T17:32:51.979205Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T21:18:11.415Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-21T21:45:31.465Z"}}},"related_cves":[{"value":"CVE-2026-114508","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"context_update":false},{"id":49997,"advisory_id":"727fdbd2-205b-417a-9dcc-813291b1c01f","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114509","source_published_at":"2026-10-21T21:49:29.486+00:00","published_at":"2026-10-25T13:59:17.421838+00:00","extraction_method":"structured","technologies":["core-cve","framework"],"cve_ids":["CVE-2026-114509"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Laravel TokenGuard authentication bypass through non-string API credentials","summary":"Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.","evidence":"cve:CVE-2026-114509","products":[{"name":{"value":"framework","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-114509","aliases":["CVE-2026-114509"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":9.2,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"laravel","product":"framework","versions":[{"status":"affected","version":"< 12.68.0"},{"status":"affected","version":">= 13.0.0, < 13.29.0"}]}],"modified":"2026-10-21T21:49:29.486Z","provider":"cve","references":["https://github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6","https://github.com/laravel/framework/commit/8dbb08bccac1be095dba4a9d259a419620f1e8a5","https://github.com/laravel/framework/commit/9b21ce0a9bb2b2599978bc0b0df4abea952ad31c","https://github.com/laravel/framework/releases/tag/v12.68.0","https://github.com/laravel/framework/releases/tag/v13.29.0"],"provider_metadata":{"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-21T21:49:29.486Z"}}},"related_cves":[{"value":"CVE-2026-114509","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"context_update":false},{"id":49349,"advisory_id":"c5e488df-52c5-4921-ba0a-3611403f4f6c","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-110803","source_published_at":"2026-10-21T18:22:59.789+00:00","published_at":"2026-10-25T13:48:27.34624+00:00","extraction_method":"structured","technologies":["core-cve","framework"],"cve_ids":["CVE-2026-110803"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Session Lock Leak on an Invalid UI Id Allows Denial of Service in Vaadin Framework 8","summary":"VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the session lock is held, so the lock is never released and the container thread returns to its pool still owning it. Every later request to that session then blocks forever in VaadinService.lockSession(), and repeating the request exhausts the thread pool and takes the application down. No authentication is required: a session cookie, which any client obtains with a single request, is enough. Vaadin 10 and later are not affected, because Flow releases the lock in a finally block and does not read that parameter there, and Vaadin Framework 7 is not affected either. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin Framework 8.16.0 - 8.32.1 Mitigation Upgrade to 8.32.2 Vaadin Framework 7 and Vaadin 10 and later do not carry this behaviour and need no upgrade for this issue. Artifacts Maven coordinates / Vulnerable versions / Fixed version com.vaadin:vaadin-server / 8.16.0 - 8.32.1 / >=8.32.2 com.vaadin:vaadin-server-mpr-jakarta / 8.18.0 - 8.32.1 / >=8.32.2","evidence":"cve:CVE-2026-110803","products":[{"name":{"value":"framework","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"framework","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-110803","aliases":["CVE-2026-110803"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NEGLIGIBLE","version":"4.0","Recovery":"USER","baseScore":8.7,"Automatable":"YES","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"DIFFUSE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","providerUrgency":"CLEAR","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/vaadin/framework","vendor":"vaadin","product":"framework","versions":[{"status":"affected","version":"8.16.0","lessThan":"8.32.2","versionType":"maven"}],"packageName":"com.vaadin:vaadin-server","collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected"},{"repo":"https://github.com/vaadin/framework","vendor":"vaadin","product":"framework","versions":[{"status":"affected","version":"8.18.0","lessThan":"8.32.2","versionType":"maven"}],"packageName":"com.vaadin:vaadin-server-mpr-jakarta","collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected"}],"modified":"2026-10-21T18:22:59.789Z","provider":"cve","references":["https://vaadin.com/security/cve-2026-110803","https://github.com/vaadin/framework/releases/tag/8.32.2"],"provider_metadata":{"cna":{"orgId":"9e0f3122-90e9-42d5-93de-8c6b98deef7e","shortName":"Vaadin","dateUpdated":"2026-10-21T18:22:59.789Z"}}},"related_cves":[{"value":"CVE-2026-110803","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"context_update":false},{"id":3468,"advisory_id":"b3332bc9-56d0-4d1f-a879-bb3419e472ad","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102279","source_published_at":"2026-09-28T20:59:36.528+00:00","published_at":"2026-10-24T21:35:52.949027+00:00","extraction_method":"structured","technologies":["core-cve","framework"],"cve_ids":["CVE-2026-102279"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Laravel: XSS in Debug Page Information","summary":"Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is fixed in versions 12.69.0 and 13.30.0.","evidence":"cve:CVE-2026-102279","products":[{"name":{"value":"framework","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-102279","aliases":["CVE-2026-102279"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.1,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"laravel","product":"framework","versions":[{"status":"affected","version":"< 12.69.0"},{"status":"affected","version":">= 13.0.0, < 13.30.0"}]}],"modified":"2026-09-29T14:44:03.594Z","provider":"cve","references":["https://github.com/laravel/framework/security/advisories/GHSA-jh5r-qr3c-85q8","https://github.com/laravel/framework/pull/61381","https://github.com/laravel/framework/commit/b495ca2ec4e15a977e8700328bf13e8a79f29d12","https://github.com/laravel/framework/releases/tag/v12.69.0","https://github.com/laravel/framework/releases/tag/v13.30.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102279","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T14:43:55.430439Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T14:44:03.594Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-28T20:59:36.528Z"}}},"related_cves":[{"value":"CVE-2026-102279","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"context_update":false}],"next_after":53269,"next_before":3468}