{ "@id": "urn:uuid:c6312d7a-455e-4b76-a302-e13b5916c78a", "role": "Document Creator", "author": "https://tuxcare.com", "version": 20, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-13T19:07:00.085664+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.2-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.2 (released December 2020) inherited the fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time compa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.2 (released December 2020) inherited the fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time compa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 8.12.2-p2+tuxcare of laravel/framework. CVE-2018-15133 describes a PHP deserialization vulnerability in Laravel's cookie decryption, allowing remote code execution via crafted X-XSRF-TOKEN values when the attacker knows the application key. The target version 8.12.2 already contains the upstream fix that disables automatic unserialization of decrypted cookie data. The fix sets static $serialize = false by default and passes this flag through the entire encryption/decryption chain (EncryptCookies::serialized() \u2192 VerifyCsrfToken::decrypt() \u2192 Encrypter::decrypt()), preventing unserialize() from being called on attacker-controlled data. The vulnerability was patched by Laravel in August 2018; version 8.12.2 (released 2020) included the fix when onboarded via snapshot commit 58ccc3bfb7 by contact@bikramlama.com.np, prior to any TuxCare involvement.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 describes a PHP deserialization vulnerability in Laravel's cookie decryption, allowing remote code execution via crafted X-XSRF-TOKEN values when the attacker knows the application key. The target version 8.12.2 already contains the upstream fix that disables automatic unserialization of decrypted cookie data. The fix sets static $serialize = false by default and passes this flag through the entire encryption/decryption chain (EncryptCookies::serialized() \u2192 VerifyCsrfToken::decrypt() \u2192 Encrypter::decrypt()), preventing unserialize() from being called on attacker-controlled data. The vulnerability was patched by Laravel in August 2018; version 8.12.2 (released 2020) included the fix when onboarded via snapshot commit 58ccc3bfb7 by contact@bikramlama.com.np, prior to any TuxCare involvement." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 8.12.2-p2+tuxcare of laravel/framework. Laravel Framework 8.12.2-p5+tuxcare contains the PendingCommand deserialization gadget (__destruct method at line 340-347) that CVE-2019-9081 describes. However, this version is not exploitable in default configuration because: (1) File-based sessions store data server-side in storage/framework/sessions/ which attackers cannot directly modify; (2) Cookie-based sessions use JSON encoding (CookieSessionHandler lines 71, 85), not PHP serialization; (3) Cache data is server-side; (4) No code path exists for attacker-controlled serialized data to reach unserialize() calls in Session\\Store (line 98) or Cache stores (FileStore line 223) without a separate vulnerability. The CVE states the vulnerability exists \"if the content is controllable\" - in default Laravel 8.12.2, serialized content is NOT attacker-controllable. While the gadget chain exists and could be exploited in combination with file upload vulnerabilities, shared hosting scenarios, or custom code that unserializes user input, these require non-default configurations or separate vulnerabilities beyond CVE-2019-9081's scope.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "Laravel Framework 8.12.2-p5+tuxcare contains the PendingCommand deserialization gadget (__destruct method at line 340-347) that CVE-2019-9081 describes. However, this version is not exploitable in default configuration because: (1) File-based sessions store data server-side in storage/framework/sessions/ which attackers cannot directly modify; (2) Cookie-based sessions use JSON encoding (CookieSessionHandler lines 71, 85), not PHP serialization; (3) Cache data is server-side; (4) No code path exists for attacker-controlled serialized data to reach unserialize() calls in Session\\Store (line 98) or Cache stores (FileStore line 223) without a separate vulnerability. The CVE states the vulnerability exists \"if the content is controllable\" - in default Laravel 8.12.2, serialized content is NOT attacker-controllable. While the gadget chain exists and could be exploited in combination with file upload vulnerabilities, shared hosting scenarios, or custom code that unserializes user input, these require non-default configurations or separate vulnerabilities beyond CVE-2019-9081's scope." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 8.12.2-p2+tuxcare of laravel/framework. The target laravel/framework version 8.12.2 is not affected by CVE-2020-19316. The vulnerability (OS command injection in the Filesystem::link() method) was fixed upstream by Taylor Otwell in May 2019 (commit 44c3feb6) for Laravel 5.8.17. The fix adds escapeshellarg() to both the $link and $target parameters before passing them to the exec() call. Since the target version 8.12.2 (released in 2020) is significantly newer than 5.8.17, the fix was already present in the upstream release that TuxCare onboarded via snapshot commit 58ccc3bfb7. The vulnerable code pattern does not exist in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "The target laravel/framework version 8.12.2 is not affected by CVE-2020-19316. The vulnerability (OS command injection in the Filesystem::link() method) was fixed upstream by Taylor Otwell in May 2019 (commit 44c3feb6) for Laravel 5.8.17. The fix adds escapeshellarg() to both the $link and $target parameters before passing them to the exec() call. Since the target version 8.12.2 (released in 2020) is significantly newer than 5.8.17, the fix was already present in the upstream release that TuxCare onboarded via snapshot commit 58ccc3bfb7. The vulnerable code pattern does not exist in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:41:18.186955+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 8.12.2-p2+tuxcare of laravel/framework. CVE-2020-24941 is NOT present in Laravel 8.12.2-p5+tuxcare. The vulnerability affects Laravel before 6.18.35 and 7.x before 7.24.0. The fix was committed to Laravel 6.x on August 7, 2020 (commit 897d107775), before Laravel 8.0.0 was released (September 8, 2020). Laravel 8.12.2 shipped with the fix already included. The target repository's snapshot commit (58ccc3bfb7) by contact@bikramlama.com.np brought in Laravel 8.12.2 with the complete fix: the isGuardableColumn() method validates that attribute keys correspond to actual database columns, preventing mass assignment bypass via non-existent column names.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941 is NOT present in Laravel 8.12.2-p5+tuxcare. The vulnerability affects Laravel before 6.18.35 and 7.x before 7.24.0. The fix was committed to Laravel 6.x on August 7, 2020 (commit 897d107775), before Laravel 8.0.0 was released (September 8, 2020). Laravel 8.12.2 shipped with the fix already included. The target repository's snapshot commit (58ccc3bfb7) by contact@bikramlama.com.np brought in Laravel 8.12.2 with the complete fix: the isGuardableColumn() method validates that attribute keys correspond to actual database columns, preventing mass assignment bypass via non-existent column names." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.2-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.2-p2+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.2-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.2-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.2-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-09-29T20:23:00.156586+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.2-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer which uses Tippy.js tooltips with allowHTML: true. Laravel 8.12.2 uses a completely different exception rendering system (Whoops/filp/whoops) that does not include Tippy.js or any JavaScript tooltip functionality. The vulnerable component was introduced in Laravel 11.x+, sever...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer which uses Tippy.js tooltips with allowHTML: true. Laravel 8.12.2 uses a completely different exception rendering system (Whoops/filp/whoops) that does not include Tippy.js or any JavaScript tooltip functionality. The vulnerable component was introduced in Laravel 11.x+, sever..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.2-p2+tuxcare of laravel/framework. not_affected \u2014 Target version 8.12.2 predates the introduction of Laravel's JSON:API resource feature by approximately 5 years. The vulnerable code (ResolvesJsonApiElements trait with loadMissing() call) does not exist in this version. JSON:API resources were first introduced in Laravel v12.45.0 (December 2025) via commit 2f309363, while the target is from the 8.x series released around 2020. Exhaustive searc...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Target version 8.12.2 predates the introduction of Laravel's JSON:API resource feature by approximately 5 years. The vulnerable code (ResolvesJsonApiElements trait with loadMissing() call) does not exist in this version. JSON:API resources were first introduced in Laravel v12.45.0 (December 2025) via commit 2f309363, while the target is from the 8.x series released around 2020. Exhaustive searc..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-11-04T11:42:00.096965+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.2-p2+tuxcare of laravel/framework, and is fixed in 8.12.2-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.2-p2+tuxcare of laravel/framework, and is fixed in 8.12.2-p6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-11-13T19:07:00.085664+00:00", "status_notes": "Vulnerability CVE-2026-128083 does not affect version 8.12.2-p2+tuxcare of laravel/framework. not_affected \u2014 The target is laravel/framework 8.12.2 (tuxcare). The Concurrency component (Concurrency::run, ProcessDriver, and the internal serialized-closure child command whose stdout result message can be forged) does not exist in this version. The CVE affects the same product lineage, so false_positive does not apply. The vulnerable input-to-goal chain is absent.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-128083" }, "impact_statement": "not_affected \u2014 The target is laravel/framework 8.12.2 (tuxcare). The Concurrency component (Concurrency::run, ProcessDriver, and the internal serialized-closure child command whose stdout result message can be forged) does not exist in this version. The CVE affects the same product lineage, so false_positive does not apply. The vulnerable input-to-goal chain is absent." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.2-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.2-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:53:45.635911+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.2-p2+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 8.12.2 is not affected by GHSA-6jvx-8ch9-j2jr (Laravel 5.6.30 cookie deserialization vulnerability). The fix disabling automatic cookie serialization was already present in the upstream Laravel 8.12.2 release, which predates TuxCare's onboarding of this repository. The vulnerable pattern (unsafe cookie deserialization enabling PHP object injection) is absent: EncryptCookies middl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target Laravel 8.12.2 is not affected by GHSA-6jvx-8ch9-j2jr (Laravel 5.6.30 cookie deserialization vulnerability). The fix disabling automatic cookie serialization was already present in the upstream Laravel 8.12.2 release, which predates TuxCare's onboarding of this repository. The vulnerable pattern (unsafe cookie deserialization enabling PHP object injection) is absent: EncryptCookies middl..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.2-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false when IV length is manipulated) was already fixed in the upstream Laravel 8.12.2 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 contains the required IV length validation that matches the vendor ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false when IV length is manipulated) was already fixed in the upstream Laravel 8.12.2 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 contains the required IV length validation that matches the vendor ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.2-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.2 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in Laravel 12.x's LocalFilesystemAdapter class which provides signed URL functionality for local filesystem storage. This feature does not exist in Laravel 8.12.2, which uses a different architecture where local filesystem adapters cannot generate temporary signed URLs.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.2 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in Laravel 12.x's LocalFilesystemAdapter class which provides signed URL functionality for local filesystem storage. This feature does not exist in Laravel 8.12.2, which uses a different architecture where local filesystem adapters cannot generate temporary signed URLs." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.2-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:14:55.406911+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 8.12.2-p2+tuxcare of laravel/framework. Laravel framework 8.12.2 is not affected by GHSA-qm5c-m76r-2hfr. The vulnerability involved using plain SHA1 hashes for cookie value prefixes, allowing attackers with access to an encryption oracle to forge valid session cookies. The fix (using HMAC with the encryption key instead of plain SHA1) was released in Laravel 6.18.31 on July 27, 2020. Laravel 8.0.0 was released on September 8, 2020, after the security fix, so all Laravel 8.x versions including 8.12.2 shipped with the fix from their original upstream release. The target contains CookieValuePrefix class using hash_hmac() at line 16, confirming the fixed pattern is present. The vulnerable pattern (plain sha1) is absent from the codebase.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Laravel framework 8.12.2 is not affected by GHSA-qm5c-m76r-2hfr. The vulnerability involved using plain SHA1 hashes for cookie value prefixes, allowing attackers with access to an encryption oracle to forge valid session cookies. The fix (using HMAC with the encryption key instead of plain SHA1) was released in Laravel 6.18.31 on July 27, 2020. Laravel 8.0.0 was released on September 8, 2020, after the security fix, so all Laravel 8.x versions including 8.12.2 shipped with the fix from their original upstream release. The target contains CookieValuePrefix class using hash_hmac() at line 16, confirming the fixed pattern is present. The vulnerable pattern (plain sha1) is absent from the codebase." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.2-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.2-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } } ] }