laravel Vulnerabilities and Affected Products
Vulnerabilities associated with reverb.
Products
Clear product- framework5 vulnerabilities
- Laravel Framework4 vulnerabilities
- livewire3 vulnerabilities
- reverb2 vulnerabilities
- Ignition1 vulnerability
- Laravel Valet1 vulnerability
- passport1 vulnerability
- pulse1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-23524CRITICAL | Laravel Redis Horizontal Scaling Insecure DeserializationLaravel Reverb provides a real-time WebSocket communication backend for Laravel applications. In versions 1.6.3 and below, Reverb passes data from the Redis channel directly into PHP’s unserialize() function without restricting which classes can be instantiated, which leaves users vulnerable to Remote Code Execution. The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication, but only affects Laravel Reverb when horizontal scaling is … CWE-502Jan 21, 2026 | CVSS9.8v3.1 | EPSS0.878% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-50347MEDIUM | Laravel Reverb has Missing API Signature VerificationLaravel Reverb provides a real-time WebSocket communication backend for Laravel applications. Prior to 1.4.0, there is an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message from a backend service or for obtaining statistical information (such as number of connections) about a given channel. This issue only affects the Pusher-compatible API endpoints and not the WebSocket con… | CVSS6.3v4.0 | EPSS0.346% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |