{
  "@id": "urn:uuid:42b01d90-c6b6-4f5d-b315-9fdbf0a13dde",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 19,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T19:07:28.312936+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T23:22:24.364492+00:00",
      "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.3-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2017-14775. The vulnerability concerned non-constant-time token comparison in remember_me token verification, which was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.3 (released in 2021) already includes the upstream fix using hash_equals() for constant-time comparison in both DatabaseUserProvider and EloquentUserProvider. The fix came w...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-14775"
      },
      "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2017-14775. The vulnerability concerned non-constant-time token comparison in remember_me token verification, which was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.3 (released in 2021) already includes the upstream fix using hash_equals() for constant-time comparison in both DatabaseUserProvider and EloquentUserProvider. The fix came w..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:44:40.573037+00:00",
      "status_notes": "Vulnerability CVE-2018-15133 does not affect version 8.12.3-p3+tuxcare of laravel/framework. CVE-2018-15133 is NOT present in this target. The vulnerability involved remote code execution via PHP object injection when decrypted cookie values (especially X-XSRF-TOKEN) were passed through unserialize(). The upstream Laravel fix (August 2018, commit 97467e3ca by Taylor Otwell) disabled serialization for all cookies by setting `protected static $serialize = false` and passing `false` to all decrypt() calls. This fix was already included in Laravel v8.12.3 (December 2020) when TuxCare onboarded it via snapshot commit 90eb977a3b. The target code at HEAD (8.12.3-p5+tuxcare) contains this upstream fix: EncryptCookies.php line 34 sets `$serialize = false`, and Encrypter.php line 151 returns decrypted values directly without calling unserialize() when the flag is false. The vulnerable pattern (unserialization of decrypted cookies) does not exist.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15133"
      },
      "impact_statement": "CVE-2018-15133 is NOT present in this target. The vulnerability involved remote code execution via PHP object injection when decrypted cookie values (especially X-XSRF-TOKEN) were passed through unserialize(). The upstream Laravel fix (August 2018, commit 97467e3ca by Taylor Otwell) disabled serialization for all cookies by setting `protected static $serialize = false` and passing `false` to all decrypt() calls. This fix was already included in Laravel v8.12.3 (December 2020) when TuxCare onboarded it via snapshot commit 90eb977a3b. The target code at HEAD (8.12.3-p5+tuxcare) contains this upstream fix: EncryptCookies.php line 34 sets `$serialize = false`, and Encrypter.php line 151 returns decrypted values directly without calling unserialize() when the flag is false. The vulnerable pattern (unserialization of decrypted cookies) does not exist."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:44:40.573037+00:00",
      "status_notes": "Vulnerability CVE-2019-9081 does not affect version 8.12.3-p3+tuxcare of laravel/framework. Laravel Framework 8.12.3 is not affected by CVE-2019-9081. While the PendingCommand class with its __destruct method exists and can execute commands when unserialized, there is no reachable attack path in Laravel's own code where attacker-controlled serialized data reaches unserialize(). The framework's unserialize() calls (e.g., Session/Store.php:98) operate on server-side data that is not directly controllable by attackers in default configuration. This is a gadget-chain component that requires an application-level unserialize vulnerability to be exploitable, not a framework vulnerability.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2019-9081"
      },
      "impact_statement": "Laravel Framework 8.12.3 is not affected by CVE-2019-9081. While the PendingCommand class with its __destruct method exists and can execute commands when unserialized, there is no reachable attack path in Laravel's own code where attacker-controlled serialized data reaches unserialize(). The framework's unserialize() calls (e.g., Session/Store.php:98) operate on server-side data that is not directly controllable by attackers in default configuration. This is a gadget-chain component that requires an application-level unserialize vulnerability to be exploitable, not a framework vulnerability."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:42:49.287382+00:00",
      "status_notes": "Vulnerability CVE-2020-19316 does not affect version 8.12.3-p3+tuxcare of laravel/framework. The target Laravel Framework 8.12.3 is NOT AFFECTED by CVE-2020-19316 (OS command injection in Filesystem.php link() function). The vulnerability was fixed upstream by Taylor Otwell in commit 44c3feb604 (May 2019, Laravel 5.8.17). The fix wraps both $link and $target parameters with escapeshellarg() before passing to the Windows mklink shell command. Laravel 8.12.3 (released December 2020) already includes this fix. Line 320 of src/Illuminate/Filesystem/Filesystem.php shows: exec(\"mklink /{$mode} \".escapeshellarg($link).' '.escapeshellarg($target)); This protection prevents shell metacharacters from being interpreted as command injection sequences. The fix shipped in the upstream release that TuxCare onboarded via snapshot commit 90eb977a3b.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-19316"
      },
      "impact_statement": "The target Laravel Framework 8.12.3 is NOT AFFECTED by CVE-2020-19316 (OS command injection in Filesystem.php link() function). The vulnerability was fixed upstream by Taylor Otwell in commit 44c3feb604 (May 2019, Laravel 5.8.17). The fix wraps both $link and $target parameters with escapeshellarg() before passing to the Windows mklink shell command. Laravel 8.12.3 (released December 2020) already includes this fix. Line 320 of src/Illuminate/Filesystem/Filesystem.php shows: exec(\"mklink /{$mode} \".escapeshellarg($link).' '.escapeshellarg($target)); This protection prevents shell metacharacters from being interpreted as command injection sequences. The fix shipped in the upstream release that TuxCare onboarded via snapshot commit 90eb977a3b."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:41:18.186955+00:00",
      "status_notes": "Vulnerability CVE-2020-24941 does not affect version 8.12.3-p3+tuxcare of laravel/framework. CVE-2020-24941 affects Laravel versions before 6.18.35 and 7.x before 7.24.0. The target repository is Laravel 8.12.3-p5+tuxcare, which was released after the CVE was fixed upstream (August 2020). The vulnerability pattern is not present in the target because the fix was already included in the upstream Laravel 8.12.3 release that TuxCare snapshotted. The GuardsAttributes.php file contains the isGuardableColumn() method and the fixed isGuarded() logic that validates attribute keys against actual database columns, preventing the mass-assignment bypass that the CVE describes.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24941"
      },
      "impact_statement": "CVE-2020-24941 affects Laravel versions before 6.18.35 and 7.x before 7.24.0. The target repository is Laravel 8.12.3-p5+tuxcare, which was released after the CVE was fixed upstream (August 2020). The vulnerability pattern is not present in the target because the fix was already included in the upstream Laravel 8.12.3 release that TuxCare snapshotted. The GuardsAttributes.php file contains the isGuardableColumn() method and the fixed isGuarded() logic that validates attribute keys against actual database columns, preventing the mass-assignment bypass that the CVE describes."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.3-p3+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "CVE-2021-21263"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.3-p3+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq",
      "vulnerability": {
        "name": "CVE-2021-43617"
      },
      "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq"
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.3-p3+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "CVE-2021-43808"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.3-p3+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "CVE-2024-52301"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.3-p3+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "CVE-2025-27515"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-29T20:27:02.675922+00:00",
      "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.3-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-102279. The vulnerability requires Laravel's modern exception renderer with Tippy.js tooltips (introduced in Laravel 11+), which does not exist in Laravel 8.12.3. This version uses the Whoops library (filp/whoops) for debug mode exception rendering and simple static HTML templates for error pages. No Tippy.js dependency, no interactive tooltips, and no...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-102279"
      },
      "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-102279. The vulnerability requires Laravel's modern exception renderer with Tippy.js tooltips (introduced in Laravel 11+), which does not exist in Laravel 8.12.3. This version uses the Whoops library (filp/whoops) for debug mode exception rendering and simple static HTML templates for error pages. No Tippy.js dependency, no interactive tooltips, and no..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T00:44:47.675175+00:00",
      "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.3-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-114508. The vulnerable JsonApi resources feature was introduced in Laravel 12.45.0, approximately 4 major versions after the target version. The entire JsonApi resources module, including the ResolvesJsonApiElements trait and sparseIncluded() method processing, does not exist in Laravel 8.x. The vulnerability requires processing HTTP query parameters w...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-114508"
      },
      "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-114508. The vulnerable JsonApi resources feature was introduced in Laravel 12.45.0, approximately 4 major versions after the target version. The entire JsonApi resources module, including the ResolvesJsonApiElements trait and sparseIncluded() method processing, does not exist in Laravel 8.x. The vulnerability requires processing HTTP query parameters w..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T11:49:41.488261+00:00",
      "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.3-p3+tuxcare of laravel/framework, and is fixed in 8.12.3-p6+tuxcare.",
      "vulnerability": {
        "name": "CVE-2026-114509"
      },
      "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.3-p3+tuxcare of laravel/framework, and is fixed in 8.12.3-p6+tuxcare."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-13T19:07:28.312936+00:00",
      "status_notes": "Vulnerability CVE-2026-128083 does not affect version 8.12.3-p3+tuxcare of laravel/framework. not_affected \u2014 Target is laravel/framework 8.12.3 (same product lineage as the CVE). The Illuminate\\Concurrency component (Concurrency::run and its process driver) did not exist until Laravel 12.x. It is absent from this tree, so the forged-result-envelope flaw cannot occur.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-128083"
      },
      "impact_statement": "not_affected \u2014 Target is laravel/framework 8.12.3 (same product lineage as the CVE). The Illuminate\\Concurrency component (Concurrency::run and its process driver) did not exist until Laravel 12.x. It is absent from this tree, so the forged-result-envelope flaw cannot occur."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.3-p3+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "GHSA-4mg9-vhxq-vm7j"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.3-p3+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "GHSA-5vg9-5847-vvmq"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T20:55:57.619283+00:00",
      "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.3-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 8.12.3 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie unserialization). The vulnerability affected Laravel 5.6.30 (August 2018) and was fixed by disabling PHP object serialization in cookie encryption. Laravel 8.12.3 (December 2020) shipped with this protection already in place: EncryptCookies uses `static $serialize = false` to prevent object unseria...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-6jvx-8ch9-j2jr"
      },
      "impact_statement": "not_affected \u2014 The target Laravel 8.12.3 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie unserialization). The vulnerability affected Laravel 5.6.30 (August 2018) and was fixed by disabling PHP object serialization in cookie encryption. Laravel 8.12.3 (December 2020) shipped with this protection already in place: EncryptCookies uses `static $serialize = false` to prevent object unseria..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T23:00:15.311032+00:00",
      "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.3-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v8.12.3 is not affected by GHSA-7852-w36x-6mf6 (Laravel Encrypter IV length validation bypass). The vulnerability pattern is absent because the upstream fix was already present in Laravel v8.12.3 when TuxCare onboarded it. The validPayload() method includes IV length validation that prevents manipulated payloads from causing false-return decryption failures exploita...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-7852-w36x-6mf6"
      },
      "impact_statement": "not_affected \u2014 The target Laravel framework v8.12.3 is not affected by GHSA-7852-w36x-6mf6 (Laravel Encrypter IV length validation bypass). The vulnerability pattern is absent because the upstream fix was already present in Laravel v8.12.3 when TuxCare onboarded it. The validPayload() method includes IV length validation that prevents manipulated payloads from causing false-return decryption failures exploita..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.3-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 does not implement local filesystem temporary signed URLs. The vulnerability targets LocalFilesystemAdapter::temporaryUrl() which was introduced in Laravel 10+. In Laravel 8.x, calling temporaryUrl() on local filesystem throws RuntimeException, preventing the attack chain from completing.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-crmm-hgp2-wgrp"
      },
      "impact_statement": "not_affected \u2014 Laravel 8.12.3 does not implement local filesystem temporary signed URLs. The vulnerability targets LocalFilesystemAdapter::temporaryUrl() which was introduced in Laravel 10+. In Laravel 8.x, calling temporaryUrl() on local filesystem throws RuntimeException, preventing the attack chain from completing."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.3-p3+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "GHSA-jwvj-pwww-3mj5"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:15:18.533137+00:00",
      "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 8.12.3-p3+tuxcare of laravel/framework. Laravel framework 8.12.3-p5+tuxcare is not affected by GHSA-qm5c-m76r-2hfr (cookie encryption oracle RCE). The vulnerability required using predictable sha1() hashes for cookie prefixes, allowing attackers with access to an encryption oracle to forge valid session cookies. The target already contains the upstream security fix that replaced sha1() with hash_hmac() using the application's secret key, making cookie prefixes unguessable. This fix was shipped in upstream Laravel 8.12.3 (released October 29, 2020) before TuxCare began maintaining this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-qm5c-m76r-2hfr"
      },
      "impact_statement": "Laravel framework 8.12.3-p5+tuxcare is not affected by GHSA-qm5c-m76r-2hfr (cookie encryption oracle RCE). The vulnerability required using predictable sha1() hashes for cookie prefixes, allowing attackers with access to an encryption oracle to forge valid session cookies. The target already contains the upstream security fix that replaced sha1() with hash_hmac() using the application's secret key, making cookie prefixes unguessable. This fix was shipped in upstream Laravel 8.12.3 (released October 29, 2020) before TuxCare began maintaining this version."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.3-p3+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "GHSA-wq8p-mqvg-2p5h"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.3-p3+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "GHSA-x7p5-p2c9-phvg"
      }
    }
  ]
}