[CRITICAL] Laravel TokenGuard authentication bypass through non-string API credentials

PKSA-b41t-wbzk-9q51 CVE-2026-114509 GHSA-f9x3-7vq9-cph6

Affected version: <12.68.0|>=13.0.0,<13.29.0

Reported by:
GitHub

[LOW] Laravel: XSS in Debug Page Information

PKSA-d5tc-s1qs-h781 CVE-2026-102279 GHSA-jh5r-qr3c-85q8

Affected version: >=13.0.0,<13.30.0|<12.69.0

Reported by:
GitHub

[MEDIUM] Laravel Framework: Temporary Signed URL Path Confusion

PKSA-m5cs-t1y6-qpcs GHSA-crmm-hgp2-wgrp

Affected version: <12.61.1|>=13.0.0,<13.12.0

Reported by:
GitHub

[HIGH] Laravel Framework: CRLF injection in default email rule

PKSA-3r5d-mb8f-1qw9 GHSA-5vg9-5847-vvmq

Affected version: <12.60.0|>=13.0.0,<=13.9.0

Reported by:
GitHub

Laravel CRLF injection in default email rule

PKSA-mdq4-51ck-6kdq CVE-2026-48019

Affected version: >=9.0.0,<10.0.0|>=10.0.0,<11.0.0|>=11.0.0,<12.0.0|>=12.0.0,<12.60.0|>=13.0.0,<13.10.0

Reported by:
FriendsOfPHP/security-advisories