{
  "@id": "urn:uuid:b19a0e93-3fec-4b6a-b131-70e0b1b389c3",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 27,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T19:07:00.085664+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 10.50.2-p3+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "AIKIDO-2026-10659"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T23:14:38.175256+00:00",
      "status_notes": "Vulnerability CVE-2017-14775 does not affect version 10.50.2-p3+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 affects Laravel before version 5.5.10 due to timing-attack vulnerability in remember-me token verification. The target repository contains Laravel 10.50.2, which is approximately 7 years newer than the fixed version. The fix (constant-time token comparison using hash_equals) was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. Both DatabaseUserProvi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-14775"
      },
      "impact_statement": "not_affected \u2014 CVE-2017-14775 affects Laravel before version 5.5.10 due to timing-attack vulnerability in remember-me token verification. The target repository contains Laravel 10.50.2, which is approximately 7 years newer than the fixed version. The fix (constant-time token comparison using hash_equals) was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. Both DatabaseUserProvi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:45:11.789246+00:00",
      "status_notes": "Vulnerability CVE-2018-15133 does not affect version 10.50.2-p3+tuxcare of laravel/framework. Laravel 10.50.2 is not affected by CVE-2018-15133 (PHP object injection via unserialized cookies). The vulnerability affected Laravel 5.5.x/5.6.x in 2018 and was fixed upstream by disabling automatic unserialization in cookie decryption. Version 10.50.2 (released in 2024) was built on the fixed codebase and contains the defense by default: `protected static $serialize = false` ensures all decrypt() calls pass `false` for the unserialize parameter, preventing dangerous unserialize() from being called on attacker-controlled cookie data. The fix was authored by Taylor Otwell (upstream Laravel maintainer) and shipped in the upstream release that TuxCare onboarded.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15133"
      },
      "impact_statement": "Laravel 10.50.2 is not affected by CVE-2018-15133 (PHP object injection via unserialized cookies). The vulnerability affected Laravel 5.5.x/5.6.x in 2018 and was fixed upstream by disabling automatic unserialization in cookie decryption. Version 10.50.2 (released in 2024) was built on the fixed codebase and contains the defense by default: `protected static $serialize = false` ensures all decrypt() calls pass `false` for the unserialize parameter, preventing dangerous unserialize() from being called on attacker-controlled cookie data. The fix was authored by Taylor Otwell (upstream Laravel maintainer) and shipped in the upstream release that TuxCare onboarded."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T18:16:23.572849+00:00",
      "status_notes": "Vulnerability CVE-2019-9081 affects version 10.50.2-p3+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "CVE-2019-9081"
      },
      "action_statement": "Vulnerability CVE-2019-9081 affects version 10.50.2-p3+tuxcare of laravel/framework."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:43:43.097163+00:00",
      "status_notes": "Vulnerability CVE-2020-19316 does not affect version 10.50.2-p3+tuxcare of laravel/framework. CVE-2020-19316 (OS command injection via unsanitized mklink parameters) does not affect Laravel Framework 10.50.2. The upstream fix (escapeshellarg on both $link and $target parameters) was introduced in Laravel 5.8.17 (May 2019) by Taylor Otwell and is present in the target version. Target version 10.50.2 is 5+ major versions after the fix, confirming it shipped in the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-19316"
      },
      "impact_statement": "CVE-2020-19316 (OS command injection via unsanitized mklink parameters) does not affect Laravel Framework 10.50.2. The upstream fix (escapeshellarg on both $link and $target parameters) was introduced in Laravel 5.8.17 (May 2019) by Taylor Otwell and is present in the target version. Target version 10.50.2 is 5+ major versions after the fix, confirming it shipped in the upstream release."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:42:04.797220+00:00",
      "status_notes": "Vulnerability CVE-2020-24941 does not affect version 10.50.2-p3+tuxcare of laravel/framework. CVE-2020-24941 is NOT present in Laravel 10.50.2-p4+tuxcare. The vulnerability involves bypassing the $guarded property using non-existent column names or JSON nesting expressions. The target contains the complete upstream fix: the isGuarded() method validates that column names exist in the database schema via isGuardableColumn(), treating non-existent columns as automatically guarded. This fix was included in the upstream Laravel 10.50.2 release and imported via TuxCare's onboarding commit (snapshot without history).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24941"
      },
      "impact_statement": "CVE-2020-24941 is NOT present in Laravel 10.50.2-p4+tuxcare. The vulnerability involves bypassing the $guarded property using non-existent column names or JSON nesting expressions. The target contains the complete upstream fix: the isGuarded() method validates that column names exist in the database schema via isGuardableColumn(), treating non-existent columns as automatically guarded. This fix was included in the upstream Laravel 10.50.2 release and imported via TuxCare's onboarding commit (snapshot without history)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:43:15.621975+00:00",
      "status_notes": "Vulnerability CVE-2021-21263 does not affect version 10.50.2-p3+tuxcare of laravel/framework. Laravel 10.50.2 is not affected by CVE-2021-21263. The vulnerability targeted Laravel versions < 6.20.12, < 7.30.3, and < 8.22.1, and was patched in January 2021. The target version (10.50.2, released in 2024) already contains the fix from the upstream release. All affected query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) now use the flattenValue() method which prevents array values from adding unexpected query bindings. This fix was present in the upstream Laravel 10.50.2 release before TuxCare's onboarding.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21263"
      },
      "impact_statement": "Laravel 10.50.2 is not affected by CVE-2021-21263. The vulnerability targeted Laravel versions < 6.20.12, < 7.30.3, and < 8.22.1, and was patched in January 2021. The target version (10.50.2, released in 2024) already contains the fix from the upstream release. All affected query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) now use the flattenValue() method which prevents array values from adding unexpected query bindings. This fix was present in the upstream Laravel 10.50.2 release before TuxCare's onboarding."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T21:27:55.132553+00:00",
      "status_notes": "Vulnerability CVE-2021-43808 does not affect version 10.50.2-p3+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 (Blade XSS via predictable parent placeholder) is NOT present in Laravel 10.50.2. The vulnerability was fixed upstream in December 2021 (Laravel 6.x/7.x/8.x), and the fix was already included when Laravel 10.x was released in February 2023. The target code shows all three components of the security fix: (1) ManagesLayouts.php generates parent placeholders using a random 40-charac...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-43808"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-43808 (Blade XSS via predictable parent placeholder) is NOT present in Laravel 10.50.2. The vulnerability was fixed upstream in December 2021 (Laravel 6.x/7.x/8.x), and the fix was already included when Laravel 10.x was released in February 2023. The target code shows all three components of the security fix: (1) ManagesLayouts.php generates parent placeholders using a random 40-charac..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:44:10.208770+00:00",
      "status_notes": "Vulnerability CVE-2024-52301 does not affect version 10.50.2-p3+tuxcare of laravel/framework. The target repository (laravel/framework 10.50.2) is NOT affected by CVE-2024-52301. The vulnerability allowed attackers to manipulate the application environment via crafted query strings when register_argc_argv was enabled. The fix\u2014checking runningInConsole() before using $_SERVER['argv'] for environment detection\u2014was already present in the upstream Laravel 10.50.2 release (Nov 12, 2024) and was imported by TuxCare via the onboarding snapshot commit. The vulnerable pattern (unconditional use of $_SERVER['argv']) is absent in the target.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-52301"
      },
      "impact_statement": "The target repository (laravel/framework 10.50.2) is NOT affected by CVE-2024-52301. The vulnerability allowed attackers to manipulate the application environment via crafted query strings when register_argc_argv was enabled. The fix\u2014checking runningInConsole() before using $_SERVER['argv'] for environment detection\u2014was already present in the upstream Laravel 10.50.2 release (Nov 12, 2024) and was imported by TuxCare via the onboarding snapshot commit. The vulnerable pattern (unconditional use of $_SERVER['argv']) is absent in the target."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T22:05:48.947173+00:00",
      "status_notes": "Vulnerability CVE-2025-27515 does not affect version 10.50.2-p3+tuxcare of laravel/framework. not_affected \u2014 The target repository (laravel/framework 10.50.2-p4+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. The fix modifies the Validator class to preserve internal placeholder encoding when passing attribute names to File/Email/Password custom rules, preventing attackers from bypassing wildcard valid...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-27515"
      },
      "impact_statement": "not_affected \u2014 The target repository (laravel/framework 10.50.2-p4+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. The fix modifies the Validator class to preserve internal placeholder encoding when passing attribute names to File/Email/Password custom rules, preventing attackers from bypassing wildcard valid..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-29T20:33:09.068963+00:00",
      "status_notes": "Vulnerability CVE-2026-102279 does not affect version 10.50.2-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.50.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's new exception renderer feature that uses Tippy.js tooltips with allowHTML:true. Laravel 10.x uses a completely different exception handling system (Whoops library) and does not contain the vulnerable code pattern. The exception renderer with Tippy.js was introduced in Laravel 12.x and does not exist i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-102279"
      },
      "impact_statement": "not_affected \u2014 Laravel 10.50.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's new exception renderer feature that uses Tippy.js tooltips with allowHTML:true. Laravel 10.x uses a completely different exception handling system (Whoops library) and does not contain the vulnerable code pattern. The exception renderer with Tippy.js was introduced in Laravel 12.x and does not exist i..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T00:51:30.888148+00:00",
      "status_notes": "Vulnerability CVE-2026-114508 does not affect version 10.50.2-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework 10.50.2-p4+tuxcare is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in the JsonApi resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 12.x (December 2025). Laravel 10.x does not contain any JsonApi resource functionality. Exhaustive searches across all 2522 files in the repository found no JsonApi-related co...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-114508"
      },
      "impact_statement": "not_affected \u2014 The target Laravel Framework 10.50.2-p4+tuxcare is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in the JsonApi resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 12.x (December 2025). Laravel 10.x does not contain any JsonApi resource functionality. Exhaustive searches across all 2522 files in the repository found no JsonApi-related co..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T15:16:50.127733+00:00",
      "status_notes": "Vulnerability CVE-2026-114509 affects version 10.50.2-p3+tuxcare of laravel/framework, and is fixed in 10.50.2-p4+tuxcare.",
      "vulnerability": {
        "name": "CVE-2026-114509"
      },
      "action_statement": "Vulnerability CVE-2026-114509 affects version 10.50.2-p3+tuxcare of laravel/framework, and is fixed in 10.50.2-p4+tuxcare."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-13T19:07:00.085664+00:00",
      "status_notes": "Vulnerability CVE-2026-128083 does not affect version 10.50.2-p3+tuxcare of laravel/framework. not_affected \u2014 Target is laravel/framework 10.50.2. The Illuminate\\Concurrency component (Concurrency::run(), the process driver that parses child stdout for a gzip-prefixed JSON result envelope) was added in a later major version and does not exist in this tree. The vulnerable pattern is absent, so the target is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-128083"
      },
      "impact_statement": "not_affected \u2014 Target is laravel/framework 10.50.2. The Illuminate\\Concurrency component (Concurrency::run(), the process driver that parses child stdout for a gzip-prefixed JSON result envelope) was added in a later major version and does not exist in this tree. The vulnerable pattern is absent, so the target is not affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T20:46:45.854078+00:00",
      "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 10.50.2-p3+tuxcare of laravel/framework. not_affected \u2014 The target (Laravel 10.50.2-p4+tuxcare) is NOT AFFECTED by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input to limit/offset/skip/take functions on SQL Server. The fix (integer casting) was already present in upstream Laravel 10.50.2 when TuxCare onboarded it on 2026-05-05. Defense exists at two layers: (1) Builder methods cast inputs via (int) before stor...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-4mg9-vhxq-vm7j"
      },
      "impact_statement": "not_affected \u2014 The target (Laravel 10.50.2-p4+tuxcare) is NOT AFFECTED by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input to limit/offset/skip/take functions on SQL Server. The fix (integer casting) was already present in upstream Laravel 10.50.2 when TuxCare onboarded it on 2026-05-05. Defense exists at two layers: (1) Builder methods cast inputs via (int) before stor..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 10.50.2-p3+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "GHSA-5vg9-5847-vvmq"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T21:02:56.515055+00:00",
      "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 10.50.2-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.50.2-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling serialization for cookies. Laravel 10.50.2 inherits this fix from upstream with a static $serialize = false property that prevents all cookie serialization. The vulnerable pattern (serialization enabled by default) is...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-6jvx-8ch9-j2jr"
      },
      "impact_statement": "not_affected \u2014 Laravel 10.50.2-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling serialization for cookies. Laravel 10.50.2 inherits this fix from upstream with a static $serialize = false property that prevents all cookie serialization. The vulnerable pattern (serialization enabled by default) is..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T23:00:15.311032+00:00",
      "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 10.50.2-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework 10.50.2 is NOT AFFECTED by GHSA-7852-w36x-6mf6 (Encrypter IV length validation vulnerability). The fix for this vulnerability was already present in the upstream Laravel 10.50.2 release when TuxCare onboarded it. The vulnerable code pattern (missing IV length validation in validPayload method) is not present in the current HEAD. The defense validates that the base64...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-7852-w36x-6mf6"
      },
      "impact_statement": "not_affected \u2014 The target Laravel framework 10.50.2 is NOT AFFECTED by GHSA-7852-w36x-6mf6 (Encrypter IV length validation vulnerability). The fix for this vulnerability was already present in the upstream Laravel 10.50.2 release when TuxCare onboarded it. The vulnerable code pattern (missing IV length validation in validPayload method) is not present in the current HEAD. The defense validates that the base64..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 10.50.2-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.50.2 does not contain the vulnerable local filesystem temporary signed URL feature. The LocalFilesystemAdapter class and its associated temporaryUrl()/temporaryUploadUrl() methods were introduced in Laravel 11.x. The vulnerable code path does not exist in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-crmm-hgp2-wgrp"
      },
      "impact_statement": "not_affected \u2014 Laravel 10.50.2 does not contain the vulnerable local filesystem temporary signed URL feature. The LocalFilesystemAdapter class and its associated temporaryUrl()/temporaryUploadUrl() methods were introduced in Laravel 11.x. The vulnerable code path does not exist in this version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T21:19:00.657885+00:00",
      "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 10.50.2-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 10.50.2-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability involves crafting HTTP request parameters as arrays (including nested arrays) where scalar values are expected, causing unexpected SQL query bindings. The fix (flattenValue method using Arr::flatten()) was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. All vulnerable ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-jwvj-pwww-3mj5"
      },
      "impact_statement": "not_affected \u2014 The target Laravel 10.50.2-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability involves crafting HTTP request parameters as arrays (including nested arrays) where scalar values are expected, causing unexpected SQL query bindings. The fix (flattenValue method using Arr::flatten()) was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. All vulnerable ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:19:00.105438+00:00",
      "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 10.50.2-p3+tuxcare of laravel/framework. Laravel Framework version 10.50.2 is not affected by GHSA-qm5c-m76r-2hfr (cookie session encryption oracle RCE vulnerability). The vulnerability was fixed upstream in Laravel 6.18.31 (July 2020) by replacing predictable sha1() cookie prefixes with HMAC-based prefixes using the secret key. Version 10.50.2 (released in 2024) already contains this fix as part of the upstream release. The target uses CookieValuePrefix class with hash_hmac for cookie prefixing, matching the patched version. No TuxCare backport was necessary for this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-qm5c-m76r-2hfr"
      },
      "impact_statement": "Laravel Framework version 10.50.2 is not affected by GHSA-qm5c-m76r-2hfr (cookie session encryption oracle RCE vulnerability). The vulnerability was fixed upstream in Laravel 6.18.31 (July 2020) by replacing predictable sha1() cookie prefixes with HMAC-based prefixes using the secret key. Version 10.50.2 (released in 2024) already contains this fix as part of the upstream release. The target uses CookieValuePrefix class with hash_hmac for cookie prefixing, matching the patched version. No TuxCare backport was necessary for this version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 10.50.2-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 10.50.2-p4+tuxcare is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). All required integer casting defenses are present in the codebase. The fix was already included in the upstream Laravel 10.50.2 release that TuxCare onboarded, prior to any TuxCare modifications. The vulnerable pattern (unvalidated user input in limit/offset parameters reaching ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-wq8p-mqvg-2p5h"
      },
      "impact_statement": "not_affected \u2014 The target Laravel 10.50.2-p4+tuxcare is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). All required integer casting defenses are present in the codebase. The fix was already included in the upstream Laravel 10.50.2 release that TuxCare onboarded, prior to any TuxCare modifications. The vulnerable pattern (unvalidated user input in limit/offset parameters reaching ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:42:13.594930+00:00",
      "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 10.50.2-p3+tuxcare of laravel/framework. The target Laravel framework 10.50.2 is NOT AFFECTED by GHSA-x7p5-p2c9-phvg. The vulnerability pattern (unchecked array-to-binding expansion) is not present because the fix was already included in the upstream Laravel 10.50.2 release. All affected query builder methods (where, having, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, whereBetween, havingBetween) implement array flattening and binding limits via the `flattenValue()` helper method and `array_slice()` guards. The fix was present in the initial TuxCare snapshot commit that onboarded Laravel 10.50.2 from upstream, indicating it shipped with the upstream release rather than being backported by TuxCare.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-x7p5-p2c9-phvg"
      },
      "impact_statement": "The target Laravel framework 10.50.2 is NOT AFFECTED by GHSA-x7p5-p2c9-phvg. The vulnerability pattern (unchecked array-to-binding expansion) is not present because the fix was already included in the upstream Laravel 10.50.2 release. All affected query builder methods (where, having, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, whereBetween, havingBetween) implement array flattening and binding limits via the `flattenValue()` helper method and `array_slice()` guards. The fix was present in the initial TuxCare snapshot commit that onboarded Laravel 10.50.2 from upstream, indicating it shipped with the upstream release rather than being backported by TuxCare."
    }
  ]
}