CVE-2026-114508
Medium · CVSS 6.5Published 2026-10-21
CVSS
6.5
Medium
EPSS
—
exploit probability
Active Exploit
No
not yet listed
What is CVE-2026-114508?
Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.
CVSS Score Explained
CVSS 6.5 is Medium severity. Exploitation usually requires some specific conditions (local access, user interaction, or a particular config). Still worth patching in your next maintenance window.
EPSS Exploitation Probability
No EPSS score yet — model needs more data on this CVE.
References & Patches
- ›https://github.com/laravel/framework/commit/50a7970efe9f9990b6ec4f1e949de2abaaf4263e
- ›https://github.com/laravel/framework/commit/b89f2944995d555bfda76dced1ef6c6b04ef17d8
- ›https://github.com/laravel/framework/pull/61322
- ›https://github.com/laravel/framework/pull/61323
- PATCHhttps://github.com/laravel/framework/releases/tag/v12.68.0
- PATCHhttps://github.com/laravel/framework/releases/tag/v13.27.0
- ›https://github.com/laravel/framework/security/advisories/GHSA-5wcm-3v2w-8362
Track vulnerabilities for your stack
Tell us what tech you run — Node.js, Python, Java, nginx, whatever — and get a weekly email when new CVEs affect it.
Recent CVEs
- CVE-2026-6945Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-113705A vulnerability was determined in a2aproject a2a-rs up to 0.4.3. This issue affects some unknown processing of the file a2a-server/src/error.rs. Executing a manipulation can lead to information exposure through error message. The attack can be executed remotely. This patch is called 713b943af94ab2d521d483b841618b97a2e78a4d. A patch should be applied to remediate this issue.6.9
- CVE-2026-112202Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images.
With `gif_consolidate => 1`, palette indices from the image are used without checking the colour table's bounds. The i_readgif_low routine reads beyond the heap allocation and copies the bytes into output pixels. The default GIF reader is not affected.
The same code ships bundled in the Imager distribution.
An attacker supplying a crafted GIF can disclose adjacent heap memory through the decoded output and may crash the process.—
- CVE-2026-9825IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing sensitive cookies to be transmitted over unencrypted connections, potentially enabling an attacker to intercept session data through network-based attacks.3.7
- CVE-2026-91668Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Dictionary Repository). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Data Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).8.8
- CVE-2026-92559IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address.9.8