Laravel · week of 26 Oct 2026

Laravel security note

Records on this stack that changed between 26 Oct 2026 and the following Monday. Versions come from the stored ranges. A quiet week is not proof the stack is clear.

What changed

CVE-2026-114509 — Patch now
Laravel is a web application framework.
Affected < 12.68.0
CVE-2026-33882 — Check if you run it
Statamic is a Laravel and Git powered content management system (CMS).
Affected < 5.73.16

What we still do not know

CVE-2026-53595 — Patch now
freescout freescout Improper Handling of Case Sensitivity
No version range is stored, so an installed version cannot be checked.
CVE-2026-105222 — Check if you run it
The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets ssl_verify_peer to FALSE, which is pass
No version range is stored, so an installed version cannot be checked.

Share this note

Laravel security note, week of 26 Oct 2026: 2 records have a version a customer can check, and 2 still do not. https://zerodayfindings.com/technologies/laravel/notes/2026-W44