CVE-2026-114508Medium· 6.5▾ SunlitLaravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user wit…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.
framework >= 12.45.0, < 12.68.0framework >= 13.0.0, < 13.27.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114509Critical· 9.2Laravel TokenGuard authentication bypass through non-string API credentials
CVE-2026-102279Low· 3.1Laravel is a web application framework
CVE-2026-48019High· 8.9Laravel is a web application framework
CVE-2026-92206High· 8.8CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability
CVE-2026-8178High· 8.1Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver
CVE-2026-112145High· 7.3speaches-ai speaches Pyannote Diarization Model Loading pyannote_diarization.py PyannoteDiarizationModelManager._load_fn externally-controlled input to select classes or code