Vendor

Laravel

As of , 3 Laravel vulnerabilities are on CISA's list of exploited vulnerabilities, 1 of them used in ransomware campaigns; 1 was added in 2026. Patch first: CVE-2018-15133.

Patch first

Patch first
#VulnerabilityProductOur groupListedDeadlineEPSS
1CVE-2018-15133Deserialization of Untrusted DataLaravel Laravel FrameworkPatch this weekMetasploit module; EPSS 0.77; verified Exploit-DB entry0.77
2CVE-2021-3129File UploadLaravel IgnitionPatch this weekRansomware use; Metasploit module; EPSS 0.990.99
3CVE-2025-54068Code InjectionLaravel LivewirePatch this weekEPSS 0.970.97

Products

  • Ignition1 entry
  • Laravel Framework1 entry
  • Livewire1 entry

Added each year

0.512023: 1120232024: 1120242025: nonenone20252026: 112026
Entries CISA added each year, removed ones included. Source: CISA KEV.
Show the numbers
Periodentries added
20231
20241
2025none
20261

Used in ransomware