{
  "@id": "urn:uuid:3136f430-9202-4c2d-ab4e-f83c0b2c86a0",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 24,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T19:07:00.085664+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 7.30.7-p2+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "AIKIDO-2026-10659"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T23:22:24.364492+00:00",
      "status_notes": "Vulnerability CVE-2017-14775 does not affect version 7.30.7-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 7.30.7-p6+tuxcare is not affected by CVE-2017-14775. Both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() comparison for remember_me tokens, preventing timing attacks. This fix was already present in the upstream Laravel 7.30.7 release (originally fixed in Laravel 5.5.10 by commit 576cba749f), which TuxCare imported via snapshot commit 5082773b92.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-14775"
      },
      "impact_statement": "not_affected \u2014 The target Laravel 7.30.7-p6+tuxcare is not affected by CVE-2017-14775. Both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() comparison for remember_me tokens, preventing timing attacks. This fix was already present in the upstream Laravel 7.30.7 release (originally fixed in Laravel 5.5.10 by commit 576cba749f), which TuxCare imported via snapshot commit 5082773b92."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:45:11.789246+00:00",
      "status_notes": "Vulnerability CVE-2018-15133 does not affect version 7.30.7-p2+tuxcare of laravel/framework. CVE-2018-15133 is NOT present in laravel/framework v7.30.7. The vulnerability affected versions through 5.5.40 and 5.6.x through 5.6.29. The target version (7.30.7, released in 2020) includes upstream fixes from August 2018 that disable PHP serialization for all encrypted cookies, preventing unsafe unserialize() calls on attacker-controlled cookie data. The fix was shipped in the upstream Laravel release, not applied by TuxCare.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15133"
      },
      "impact_statement": "CVE-2018-15133 is NOT present in laravel/framework v7.30.7. The vulnerability affected versions through 5.5.40 and 5.6.x through 5.6.29. The target version (7.30.7, released in 2020) includes upstream fixes from August 2018 that disable PHP serialization for all encrypted cookies, preventing unsafe unserialize() calls on attacker-controlled cookie data. The fix was shipped in the upstream Laravel release, not applied by TuxCare."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T18:16:23.572849+00:00",
      "status_notes": "Vulnerability CVE-2019-9081 affects version 7.30.7-p2+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "CVE-2019-9081"
      },
      "action_statement": "Vulnerability CVE-2019-9081 affects version 7.30.7-p2+tuxcare of laravel/framework."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:43:43.097163+00:00",
      "status_notes": "Vulnerability CVE-2020-19316 does not affect version 7.30.7-p2+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework before version 5.8.17. The target version 7.30.7-p6+tuxcare already contains the upstream fix. The vulnerability was an OS command injection in the `link()` function in Filesystem.php, where user-controlled `$link` and `$target` parameters were passed to `exec(\"mklink ...\")` without proper escaping. The fix, applied by Laravel upstream in May 2019 (commit 44c3feb6), wraps both parameters with `escapeshellarg()` to prevent shell metacharacter injection. This fix was already present in Laravel 7.30.7 when TuxCare onboarded it in the snapshot commit 5082773b92.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-19316"
      },
      "impact_statement": "CVE-2020-19316 affects Laravel Framework before version 5.8.17. The target version 7.30.7-p6+tuxcare already contains the upstream fix. The vulnerability was an OS command injection in the `link()` function in Filesystem.php, where user-controlled `$link` and `$target` parameters were passed to `exec(\"mklink ...\")` without proper escaping. The fix, applied by Laravel upstream in May 2019 (commit 44c3feb6), wraps both parameters with `escapeshellarg()` to prevent shell metacharacter injection. This fix was already present in Laravel 7.30.7 when TuxCare onboarded it in the snapshot commit 5082773b92."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:42:21.835037+00:00",
      "status_notes": "Vulnerability CVE-2020-24941 does not affect version 7.30.7-p2+tuxcare of laravel/framework. The target repository (laravel/framework v7.30.7-p6+tuxcare) is NOT vulnerable to CVE-2020-24941. The vulnerability affected Laravel versions before 6.18.35 and 7.x before 7.24.0. The target version 7.30.7 is greater than 7.24.0, and the fix was already present in the upstream v7.30.7 release that was onboarded into the TuxCare branch via snapshot commit 5082773b92. The fix adds validation to ensure mass-assigned attributes are actual database columns, preventing attackers from bypassing the $guarded property protection using fake column names with JSON-like syntax. The vulnerable code pattern (missing isGuardableColumn validation) is not present in the target.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24941"
      },
      "impact_statement": "The target repository (laravel/framework v7.30.7-p6+tuxcare) is NOT vulnerable to CVE-2020-24941. The vulnerability affected Laravel versions before 6.18.35 and 7.x before 7.24.0. The target version 7.30.7 is greater than 7.24.0, and the fix was already present in the upstream v7.30.7 release that was onboarded into the TuxCare branch via snapshot commit 5082773b92. The fix adds validation to ensure mass-assigned attributes are actual database columns, preventing attackers from bypassing the $guarded property protection using fake column names with JSON-like syntax. The vulnerable code pattern (missing isGuardableColumn validation) is not present in the target."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:43:43.097163+00:00",
      "status_notes": "Vulnerability CVE-2021-21263 does not affect version 7.30.7-p2+tuxcare of laravel/framework. CVE-2021-21263 affects Laravel versions <6.20.12, <7.30.3, and <8.22.1. The target is Laravel v7.30.7-p6+tuxcare, which is >7.30.3. The upstream Laravel v7.30.7 release already included the fix via the flattenValue() method and array_slice() limiting, which was snapshotted into the TuxCare branch. All affected query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) now properly limit array inputs to prevent query binding exploitation. The vulnerable pattern is not present in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21263"
      },
      "impact_statement": "CVE-2021-21263 affects Laravel versions <6.20.12, <7.30.3, and <8.22.1. The target is Laravel v7.30.7-p6+tuxcare, which is >7.30.3. The upstream Laravel v7.30.7 release already included the fix via the flattenValue() method and array_slice() limiting, which was snapshotted into the TuxCare branch. All affected query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) now properly limit array inputs to prevent query binding exploitation. The vulnerable pattern is not present in this version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 7.30.7-p2+tuxcare.",
      "vulnerability": {
        "name": "CVE-2021-43617"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T21:27:55.132553+00:00",
      "status_notes": "Vulnerability CVE-2021-43808 does not affect version 7.30.7-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2021-43808 (Blade XSS via predictable parent placeholder). The upstream fix was already present in v7.30.7 when TuxCare onboarded it. The fix implements random per-request salt for parent placeholders, making them unguessable and preventing XSS exploitation.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-43808"
      },
      "impact_statement": "not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2021-43808 (Blade XSS via predictable parent placeholder). The upstream fix was already present in v7.30.7 when TuxCare onboarded it. The fix implements random per-request salt for parent placeholders, making them unguessable and preventing XSS exploitation."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:44:10.208770+00:00",
      "status_notes": "Vulnerability CVE-2024-52301 does not affect version 7.30.7-p2+tuxcare of laravel/framework. The target repository (Laravel framework v7.30.7-p6+tuxcare) is NOT vulnerable to CVE-2024-52301. The vulnerability involves environment manipulation via crafted query strings when register_argc_argv is enabled. The fix\u2014checking runningInConsole() before using $_SERVER['argv']\u2014was already present in the upstream Laravel v7.30.7 release that TuxCare imported via snapshot on 2026-05-05. The upstream fix was authored by Taylor Otwell on 2024-11-12. The target code at Application.php:560-562 correctly guards $_SERVER['argv'] access, preventing web requests from manipulating the framework's environment detection.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-52301"
      },
      "impact_statement": "The target repository (Laravel framework v7.30.7-p6+tuxcare) is NOT vulnerable to CVE-2024-52301. The vulnerability involves environment manipulation via crafted query strings when register_argc_argv is enabled. The fix\u2014checking runningInConsole() before using $_SERVER['argv']\u2014was already present in the upstream Laravel v7.30.7 release that TuxCare imported via snapshot on 2026-05-05. The upstream fix was authored by Taylor Otwell on 2024-11-12. The target code at Application.php:560-562 correctly guards $_SERVER['argv'] access, preventing web requests from manipulating the framework's environment detection."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 7.30.7-p2+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "CVE-2025-27515"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-29T20:36:58.499788+00:00",
      "status_notes": "Vulnerability CVE-2026-102279 does not affect version 7.30.7-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is NOT affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's exception renderer system which uses Tippy.js tooltips with `allowHTML: true` on user-controlled data. Laravel 7.30.7 predates this feature entirely and uses the Whoops library for debug mode exception handling - a completely different architecture with no Tippy.js tooltips, no `data-tippy-content` att...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-102279"
      },
      "impact_statement": "not_affected \u2014 Laravel 7.30.7 is NOT affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's exception renderer system which uses Tippy.js tooltips with `allowHTML: true` on user-controlled data. Laravel 7.30.7 predates this feature entirely and uses the Whoops library for debug mode exception handling - a completely different architecture with no Tippy.js tooltips, no `data-tippy-content` att..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T00:51:30.888148+00:00",
      "status_notes": "Vulnerability CVE-2026-114508 does not affect version 7.30.7-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource system, which was introduced in version 12.x, five major versions after the target. The vulnerable pattern requires: (1) JsonApi resources processing user-supplied `include` query parameters, (2) passing unsanitized nested relationship names to `loadMissing()`, and (3) potential invocation ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-114508"
      },
      "impact_statement": "not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource system, which was introduced in version 12.x, five major versions after the target. The vulnerable pattern requires: (1) JsonApi resources processing user-supplied `include` query parameters, (2) passing unsanitized nested relationship names to `loadMissing()`, and (3) potential invocation ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-04T11:50:18.837974+00:00",
      "status_notes": "Vulnerability CVE-2026-114509 affects version 7.30.7-p2+tuxcare of laravel/framework, and is fixed in 7.30.7-p7+tuxcare.",
      "vulnerability": {
        "name": "CVE-2026-114509"
      },
      "action_statement": "Vulnerability CVE-2026-114509 affects version 7.30.7-p2+tuxcare of laravel/framework, and is fixed in 7.30.7-p7+tuxcare."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-13T19:07:00.085664+00:00",
      "status_notes": "Vulnerability CVE-2026-128083 does not affect version 7.30.7-p2+tuxcare of laravel/framework. not_affected \u2014 Target is laravel/framework 7.30.7 (TuxCare p7). The CVE concerns the Illuminate\\Concurrency component (Concurrency::run() and its process driver, which reads a child's stdout for a result envelope). That component was added in much later releases (the fixes are 12.71.0 and 13.40.0) and does not exist in this tree. No code here parses a child process's stdout as a trusted, unserialized result m...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-128083"
      },
      "impact_statement": "not_affected \u2014 Target is laravel/framework 7.30.7 (TuxCare p7). The CVE concerns the Illuminate\\Concurrency component (Concurrency::run() and its process driver, which reads a child's stdout for a result envelope). That component was added in much later releases (the fixes are 12.71.0 and 13.40.0) and does not exist in this tree. No code here parses a child process's stdout as a trusted, unserialized result m..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T20:52:18.183384+00:00",
      "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 7.30.7-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework v7.30.7-p6+tuxcare is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is absent because the upstream Laravel v7.30.5 release already included the fix, which adds integer casting to limit() and offset() methods in Builder.php. This version (7.30.7) inherits that upstream fix via the snapshot commit that imported the v7.30.7...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-4mg9-vhxq-vm7j"
      },
      "impact_statement": "not_affected \u2014 Laravel Framework v7.30.7-p6+tuxcare is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is absent because the upstream Laravel v7.30.5 release already included the fix, which adds integer casting to limit() and offset() methods in Builder.php. This version (7.30.7) inherits that upstream fix via the snapshot commit that imported the v7.30.7..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 7.30.7-p2+tuxcare of laravel/framework, and is fixed in 7.30.7-p3+tuxcare.",
      "vulnerability": {
        "name": "GHSA-5vg9-5847-vvmq"
      },
      "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 7.30.7-p2+tuxcare of laravel/framework, and is fixed in 7.30.7-p3+tuxcare."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T21:03:57.153420+00:00",
      "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 7.30.7-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 7.30.7-p6+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling PHP object serialization in cookies. Laravel 7.30.7 (released September 2020) already contains this fix. The target was onboarded from the upstream Laravel 7.30.7 release, which shipped wit...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-6jvx-8ch9-j2jr"
      },
      "impact_statement": "not_affected \u2014 The target Laravel framework version 7.30.7-p6+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling PHP object serialization in cookies. Laravel 7.30.7 (released September 2020) already contains this fix. The target was onboarded from the upstream Laravel 7.30.7 release, which shipped wit..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T23:07:07.266705+00:00",
      "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 7.30.7-p2+tuxcare of laravel/framework. not_affected \u2014 Target Laravel v7.30.7 already contains the upstream IV length validation fix. The vulnerability (GHSA-7852-w36x-6mf6) allows decryption to return false instead of throwing an exception when processing payloads with manipulated IV length. The fix validates that decoded IV length matches expected cipher IV length (Encrypter.php:214). This was authored by Taylor Otwell on March 30, 2018, and ship...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-7852-w36x-6mf6"
      },
      "impact_statement": "not_affected \u2014 Target Laravel v7.30.7 already contains the upstream IV length validation fix. The vulnerability (GHSA-7852-w36x-6mf6) allows decryption to return false instead of throwing an exception when processing payloads with manipulated IV length. The fix validates that decoded IV length matches expected cipher IV length (Encrypter.php:214). This was authored by Taylor Otwell on March 30, 2018, and ship..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 7.30.7-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7-p1+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in the LocalFilesystemAdapter class which provides temporary signed URL generation for local filesystems. This class and the associated local file serving feature were introduced in Laravel 9.x and do not exist in Laravel 7.x.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-crmm-hgp2-wgrp"
      },
      "impact_statement": "not_affected \u2014 Laravel 7.30.7-p1+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in the LocalFilesystemAdapter class which provides temporary signed URL generation for local filesystems. This class and the associated local file serving feature were introduced in Laravel 9.x and do not exist in Laravel 7.x."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T21:20:09.538096+00:00",
      "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 7.30.7-p2+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 7.30.7 is NOT AFFECTED. All security fixes for GHSA-jwvj-pwww-3mj5 (preventing unexpected query bindings from array-valued parameters) were already present in the upstream Laravel 7.30.7 release before TuxCare created the snapshot. The target contains the `flattenValue()` method and uses it in all affected query builder methods (where, having, whereDate, whereTime, whereDay, wher...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-jwvj-pwww-3mj5"
      },
      "impact_statement": "not_affected \u2014 Target Laravel 7.30.7 is NOT AFFECTED. All security fixes for GHSA-jwvj-pwww-3mj5 (preventing unexpected query bindings from array-valued parameters) were already present in the upstream Laravel 7.30.7 release before TuxCare created the snapshot. The target contains the `flattenValue()` method and uses it in all affected query builder methods (where, having, whereDate, whereTime, whereDay, wher..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:19:00.105438+00:00",
      "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 7.30.7-p2+tuxcare of laravel/framework. Laravel framework 7.30.7 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (RCE via cookie session driver + encryption oracle). The vulnerability was fixed in upstream Laravel 7.22.2 (July 27, 2020) by replacing the publicly-computable SHA1 hash cookie prefix with an HMAC requiring the secret encryption key. Laravel 7.30.7 (released October 22, 2020) already contains this fix. The TuxCare snapshot merely imported the already-patched upstream version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-qm5c-m76r-2hfr"
      },
      "impact_statement": "Laravel framework 7.30.7 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (RCE via cookie session driver + encryption oracle). The vulnerability was fixed in upstream Laravel 7.22.2 (July 27, 2020) by replacing the publicly-computable SHA1 hash cookie prefix with an HMAC requiring the secret encryption key. Laravel 7.30.7 (released October 22, 2020) already contains this fix. The TuxCare snapshot merely imported the already-patched upstream version."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T18:16:23.572849+00:00",
      "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 7.30.7-p2+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "GHSA-wq8p-mqvg-2p5h"
      },
      "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 7.30.7-p2+tuxcare of laravel/framework."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:42:21.835037+00:00",
      "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 7.30.7-p2+tuxcare of laravel/framework. Laravel framework 7.30.7-p6+tuxcare is NOT affected by GHSA-x7p5-p2c9-phvg (unexpected query binding vulnerability). The fix was already present in the upstream Laravel v7.30.7 release, which was onboarded by TuxCare. All vulnerable query builder methods (where, having, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, havingBetween) correctly use flattenValue() to extract scalar values from arrays and limit bindings appropriately.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-x7p5-p2c9-phvg"
      },
      "impact_statement": "Laravel framework 7.30.7-p6+tuxcare is NOT affected by GHSA-x7p5-p2c9-phvg (unexpected query binding vulnerability). The fix was already present in the upstream Laravel v7.30.7 release, which was onboarded by TuxCare. All vulnerable query builder methods (where, having, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, havingBetween) correctly use flattenValue() to extract scalar values from arrays and limit bindings appropriately."
    }
  ]
}