[CRITICAL] Livewire is vulnerable to remote command execution during component property update hydration

PKSA-g5js-3ypd-k2kr CVE-2025-54068 GHSA-29cq-5w36-x7w3

Affected version: >=3.0.0-beta.1,<3.6.4

Reported by:
GitHub

[HIGH] Livewire Remote Code Execution on File Uploads

PKSA-9tny-xycd-bd72 CVE-2024-47823 GHSA-f3cx-396f-7jqp

Affected version: <2.12.7|>=3.0.0-beta.1,<3.5.2

Reported by:
GitHub

[MEDIUM] Cross-site Scripting in livewire/livewire

PKSA-zng9-t7vy-y8kf CVE-2024-21504 GHSA-389c-cf87-qmwj

Affected version: >=3.3.5,<3.4.9

Reported by:
GitHub

[MEDIUM] $this->validate() returns all properties, not just validated ones

PKSA-j3wc-rwc2-n9k9 GHSA-qwvp-268g-jjm8

Affected version: >2.2.4,<2.2.6

Reported by:
GitHub, FriendsOfPHP/security-advisories