{
  "@id": "urn:uuid:582df9e1-ddf8-4dac-a52e-f71b9a8b4f87",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 25,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T19:07:00.085664+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-16T13:35:00.548500+00:00",
      "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 8.83.29-p5+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "AIKIDO-2026-10659"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T23:14:38.175256+00:00",
      "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.83.29-p5+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 does not affect this target. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.83.29, released years later, inherited this fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use PHP's hash_equals() for constant-time token comparison at line 77. The TuxCare onbo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-14775"
      },
      "impact_statement": "not_affected \u2014 CVE-2017-14775 does not affect this target. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.83.29, released years later, inherited this fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use PHP's hash_equals() for constant-time token comparison at line 77. The TuxCare onbo..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:45:11.789246+00:00",
      "status_notes": "Vulnerability CVE-2018-15133 does not affect version 8.83.29-p5+tuxcare of laravel/framework. CVE-2018-15133 affects Laravel Framework through 5.5.40 and 5.6.x through 5.6.29 via unserialize on untrusted X-XSRF-TOKEN values. The target (Laravel 8.83.29) ships with the upstream fix already present. The defense (static::$serialize = false; static::serialized() returning false) disables automatic unserialization after cookie/CSRF token decryption, preventing PHP object injection attacks. The fix was introduced by Taylor Otwell in upstream patches 240d9046 and c0eb9073 (Aug 2018) and is present in all Laravel 8.x releases. The vulnerable pattern (decrypt with unserialize enabled by default) does not exist in the target.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15133"
      },
      "impact_statement": "CVE-2018-15133 affects Laravel Framework through 5.5.40 and 5.6.x through 5.6.29 via unserialize on untrusted X-XSRF-TOKEN values. The target (Laravel 8.83.29) ships with the upstream fix already present. The defense (static::$serialize = false; static::serialized() returning false) disables automatic unserialization after cookie/CSRF token decryption, preventing PHP object injection attacks. The fix was introduced by Taylor Otwell in upstream patches 240d9046 and c0eb9073 (Aug 2018) and is present in all Laravel 8.x releases. The vulnerable pattern (decrypt with unserialize enabled by default) does not exist in the target."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T18:16:23.572849+00:00",
      "status_notes": "Vulnerability CVE-2019-9081 affects version 8.83.29-p5+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "CVE-2019-9081"
      },
      "action_statement": "Vulnerability CVE-2019-9081 affects version 8.83.29-p5+tuxcare of laravel/framework."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:42:49.287382+00:00",
      "status_notes": "Vulnerability CVE-2020-19316 does not affect version 8.83.29-p5+tuxcare of laravel/framework. Laravel Framework 8.83.29 is not affected by CVE-2020-19316. The OS command injection vulnerability in the Filesystem::link() function was fixed upstream in May 2019 (commit 44c3feb604) for Laravel 5.8.17. Version 8.83.29 was released much later and already included this fix when it was onboarded into the TuxCare repository. The current code at src/Illuminate/Filesystem/Filesystem.php:337 properly applies escapeshellarg() to both $link and $target parameters before passing them to the exec() function, preventing command injection.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-19316"
      },
      "impact_statement": "Laravel Framework 8.83.29 is not affected by CVE-2020-19316. The OS command injection vulnerability in the Filesystem::link() function was fixed upstream in May 2019 (commit 44c3feb604) for Laravel 5.8.17. Version 8.83.29 was released much later and already included this fix when it was onboarded into the TuxCare repository. The current code at src/Illuminate/Filesystem/Filesystem.php:337 properly applies escapeshellarg() to both $link and $target parameters before passing them to the exec() function, preventing command injection."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:41:26.189153+00:00",
      "status_notes": "Vulnerability CVE-2020-24941 does not affect version 8.83.29-p5+tuxcare of laravel/framework. CVE-2020-24941 does not affect Laravel 8.83.29. The vulnerability (mass assignment bypass via non-column attribute keys) was fixed in Laravel 6.18.35 and 7.24.0 (August 2020). Laravel 8.x was released in September 2020, after the fix, so all 8.x versions including 8.83.29 shipped with the fix already present. The target repository's GuardsAttributes.php contains the complete fix: the isGuardableColumn() method validates attribute keys against actual database columns, and non-column keys are automatically treated as guarded (blocked). This fix came from upstream Laravel, not from a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24941"
      },
      "impact_statement": "CVE-2020-24941 does not affect Laravel 8.83.29. The vulnerability (mass assignment bypass via non-column attribute keys) was fixed in Laravel 6.18.35 and 7.24.0 (August 2020). Laravel 8.x was released in September 2020, after the fix, so all 8.x versions including 8.83.29 shipped with the fix already present. The target repository's GuardsAttributes.php contains the complete fix: the isGuardableColumn() method validates attribute keys against actual database columns, and non-column keys are automatically treated as guarded (blocked). This fix came from upstream Laravel, not from a TuxCare backport."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:42:49.287382+00:00",
      "status_notes": "Vulnerability CVE-2021-21263 does not affect version 8.83.29-p5+tuxcare of laravel/framework. CVE-2021-21263 is not present in laravel/framework 8.83.29-p6+tuxcare. The vulnerability (query binding exploitation via unchecked array inputs) was fixed in upstream Laravel 8.22.1, and the target version 8.83.29 already contains the fix as shipped in the upstream release. The fix uses a flattenValue() helper method that limits array inputs to their first element, preventing unexpected query bindings in where(), whereBetween(), whereDate/Time/Day/Month/Year(), whereJsonLength(), and having() methods.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21263"
      },
      "impact_statement": "CVE-2021-21263 is not present in laravel/framework 8.83.29-p6+tuxcare. The vulnerability (query binding exploitation via unchecked array inputs) was fixed in upstream Laravel 8.22.1, and the target version 8.83.29 already contains the fix as shipped in the upstream release. The fix uses a flattenValue() helper method that limits array inputs to their first element, preventing unexpected query bindings in where(), whereBetween(), whereDate/Time/Day/Month/Year(), whereJsonLength(), and having() methods."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T21:22:31.131193+00:00",
      "status_notes": "Vulnerability CVE-2021-43808 does not affect version 8.83.29-p5+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 does not affect this target. The vulnerability (predictable parent placeholder hashes in Blade templates allowing XSS) was fixed by the upstream Laravel team before version 8.83.29 was released. The complete fix\u2014including random per-request salt generation, runtime placeholder creation, and cache invalidation\u2014is present in all three affected files. TuxCare onboarded an already-fi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-43808"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-43808 does not affect this target. The vulnerability (predictable parent placeholder hashes in Blade templates allowing XSS) was fixed by the upstream Laravel team before version 8.83.29 was released. The complete fix\u2014including random per-request salt generation, runtime placeholder creation, and cache invalidation\u2014is present in all three affected files. TuxCare onboarded an already-fi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-16T13:35:00.548500+00:00",
      "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 8.83.29-p5+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"",
      "vulnerability": {
        "name": "CVE-2022-31279"
      },
      "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\""
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:43:43.097163+00:00",
      "status_notes": "Vulnerability CVE-2024-52301 does not affect version 8.83.29-p5+tuxcare of laravel/framework. CVE-2024-52301 is NOT present in Laravel 8.83.29-p6+tuxcare. The vulnerability allowed attackers to manipulate the application environment via crafted query strings when register_argc_argv is enabled. The fix (checking runningInConsole() before using $_SERVER['argv']) was already present in the upstream code when TuxCare onboarded version 8.83.29 on Aug 25, 2025. The upstream fix was authored by Taylor Otwell and applied to all maintained Laravel branches in November 2024.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-52301"
      },
      "impact_statement": "CVE-2024-52301 is NOT present in Laravel 8.83.29-p6+tuxcare. The vulnerability allowed attackers to manipulate the application environment via crafted query strings when register_argc_argv is enabled. The fix (checking runningInConsole() before using $_SERVER['argv']) was already present in the upstream code when TuxCare onboarded version 8.83.29 on Aug 25, 2025. The upstream fix was authored by Taylor Otwell and applied to all maintained Laravel branches in November 2024."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-16T13:35:00.548500+00:00",
      "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.83.29-p5+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "CVE-2025-27515"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-16T13:35:00.548500+00:00",
      "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.83.29-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-102279. The vulnerability exists in the new exception renderer with Tippy.js tooltips (allowHTML: true) introduced in Laravel 12.x. The target version uses Whoops library's PrettyPageHandler for debug exception rendering instead, which does not have Tippy.js or any tooltip system that could be exploited via attacker-controlled HTML content.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-102279"
      },
      "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-102279. The vulnerability exists in the new exception renderer with Tippy.js tooltips (allowHTML: true) introduced in Laravel 12.x. The target version uses Whoops library's PrettyPageHandler for debug exception rendering instead, which does not have Tippy.js or any tooltip system that could be exploited via attacker-controlled HTML content."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T00:44:47.675175+00:00",
      "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.83.29-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource relationship inclusion processing feature, which was introduced in Laravel 12.x (commit 2f30936319193371fc1ac338d171a5b92be9976de5). This feature is completely absent from Laravel 8.x. The vulnerable code path in ResolvesJsonApiElements.php does not exist in this version. The standard JsonResou...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-114508"
      },
      "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource relationship inclusion processing feature, which was introduced in Laravel 12.x (commit 2f30936319193371fc1ac338d171a5b92be9976de5). This feature is completely absent from Laravel 8.x. The vulnerable code path in ResolvesJsonApiElements.php does not exist in this version. The standard JsonResou..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T12:27:44.661604+00:00",
      "status_notes": "Vulnerability CVE-2026-114509 affects version 8.83.29-p5+tuxcare of laravel/framework, and is fixed in 8.83.29-p6+tuxcare.",
      "vulnerability": {
        "name": "CVE-2026-114509"
      },
      "action_statement": "Vulnerability CVE-2026-114509 affects version 8.83.29-p5+tuxcare of laravel/framework, and is fixed in 8.83.29-p6+tuxcare."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-13T19:07:00.085664+00:00",
      "status_notes": "Vulnerability CVE-2026-128083 does not affect version 8.83.29-p5+tuxcare of laravel/framework. not_affected \u2014 Target is laravel/framework 8.83.29, which has no Illuminate\\Concurrency component. The CVE concerns Concurrency::run() and its process driver, which read a child process's stdout and decode a framework result message. That feature appeared in later releases (the CVE patches are 12.71.0 and 13.40.0). No equivalent child-stdout result channel exists in this tree, so the vulnerable chain cannot b...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-128083"
      },
      "impact_statement": "not_affected \u2014 Target is laravel/framework 8.83.29, which has no Illuminate\\Concurrency component. The CVE concerns Concurrency::run() and its process driver, which read a child process's stdout and decode a framework result message. That feature appeared in later releases (the CVE patches are 12.71.0 and 13.40.0). No equivalent child-stdout result channel exists in this tree, so the vulnerable chain cannot b..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T20:45:27.177095+00:00",
      "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 8.83.29-p5+tuxcare of laravel/framework. not_affected \u2014 The SQL injection vulnerability (GHSA-4mg9-vhxq-vm7j) affecting Laravel's SQL Server driver when user input is passed to limit/offset/skip/take functions is NOT present in this target. The vulnerability was fixed in upstream Laravel 8.40.0, and the target version 8.83.29 already contains the fix. Integer casting defenses are present in both Builder.php (lines 2140, 2167) and SqlServerGrammar.ph...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-4mg9-vhxq-vm7j"
      },
      "impact_statement": "not_affected \u2014 The SQL injection vulnerability (GHSA-4mg9-vhxq-vm7j) affecting Laravel's SQL Server driver when user input is passed to limit/offset/skip/take functions is NOT present in this target. The vulnerability was fixed in upstream Laravel 8.40.0, and the target version 8.83.29 already contains the fix. Integer casting defenses are present in both Builder.php (lines 2140, 2167) and SqlServerGrammar.ph..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-16T13:35:00.548500+00:00",
      "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.83.29-p5+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "GHSA-5vg9-5847-vvmq"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T20:58:09.118737+00:00",
      "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.83.29-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The vulnerable pattern was fixed by upstream Laravel in version 5.6.30 (August 2018), and Laravel 8.83.29 (released September 2022) inherited this fix. The target uses `protected static $serialize = false` to disable PHP object serialization for all cookies, preventing CWE-502 deserialization attacks....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-6jvx-8ch9-j2jr"
      },
      "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The vulnerable pattern was fixed by upstream Laravel in version 5.6.30 (August 2018), and Laravel 8.83.29 (released September 2022) inherited this fix. The target uses `protected static $serialize = false` to disable PHP object serialization for all cookies, preventing CWE-502 deserialization attacks...."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T23:00:15.311032+00:00",
      "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.83.29-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework 8.83.29-p6+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability pattern (missing IV length validation in Encrypter::validPayload) is not present in the target. The fix was already included in the upstream Laravel 8.83.29 release when TuxCare onboarded it in August 2025. The IV length validation check (strlen(base64_decode($payload['iv'], true)) === open...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-7852-w36x-6mf6"
      },
      "impact_statement": "not_affected \u2014 The target Laravel framework 8.83.29-p6+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability pattern (missing IV length validation in Encrypter::validPayload) is not present in the target. The fix was already included in the upstream Laravel 8.83.29 release when TuxCare onboarded it in August 2025. The IV length validation check (strlen(base64_decode($payload['iv'], true)) === open..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-16T13:35:00.548500+00:00",
      "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.83.29-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerable component (LocalFilesystemAdapter with local filesystem signed URL serving) was introduced in Laravel 11.x/12.x and does not exist in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-crmm-hgp2-wgrp"
      },
      "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerable component (LocalFilesystemAdapter with local filesystem signed URL serving) was introduced in Laravel 11.x/12.x and does not exist in this version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T21:13:49.604159+00:00",
      "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 8.83.29-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.83.29 is NOT AFFECTED by GHSA-jwvj-pwww-3mj5. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalars. The upstream Laravel 8.83.29 release (November 2024) already contains the complete fix via the flattenValue() method and array flattening+slicing logic applied to all vulnerable methods ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-jwvj-pwww-3mj5"
      },
      "impact_statement": "not_affected \u2014 The target Laravel framework version 8.83.29 is NOT AFFECTED by GHSA-jwvj-pwww-3mj5. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalars. The upstream Laravel 8.83.29 release (November 2024) already contains the complete fix via the flattenValue() method and array flattening+slicing logic applied to all vulnerable methods ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:15:18.533137+00:00",
      "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 8.83.29-p5+tuxcare of laravel/framework. The target Laravel 8.83.29 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (cookie encryption oracle RCE). The fix replacing predictable SHA1 cookie prefixes with HMAC-keyed prefixes was already present in the upstream Laravel 8.83.29 release when TuxCare onboarded it (commit 838fe2b62d, Aug 2025). The vulnerability was fixed upstream by Taylor Otwell in July 2020. The target code uses CookieValuePrefix::create() with hash_hmac, preventing attackers from forging valid cookie prefixes even with an encryption oracle.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-qm5c-m76r-2hfr"
      },
      "impact_statement": "The target Laravel 8.83.29 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (cookie encryption oracle RCE). The fix replacing predictable SHA1 cookie prefixes with HMAC-keyed prefixes was already present in the upstream Laravel 8.83.29 release when TuxCare onboarded it (commit 838fe2b62d, Aug 2025). The vulnerability was fixed upstream by Taylor Otwell in July 2020. The target code uses CookieValuePrefix::create() with hash_hmac, preventing attackers from forging valid cookie prefixes even with an encryption oracle."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T22:44:11.275398+00:00",
      "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 8.83.29-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.83.29 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched upstream in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Since version 8.83.29 > 8.40.0, the fix was already present in the upstream release that TuxCare onboarded. All four vulnerable entry points (limit/offset/skip/ta...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-wq8p-mqvg-2p5h"
      },
      "impact_statement": "not_affected \u2014 The target Laravel framework version 8.83.29 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched upstream in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Since version 8.83.29 > 8.40.0, the fix was already present in the upstream release that TuxCare onboarded. All four vulnerable entry points (limit/offset/skip/ta..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:41:35.131174+00:00",
      "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 8.83.29-p5+tuxcare of laravel/framework. The target Laravel 8.83.29 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability involves unexpected query bindings when array values are passed to query builder methods expecting scalars. All affected methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) already use the flattenValue() helper method to extract scalar values from arrays, which provides the same protection as the upstream patches. This fix was already present in the upstream Laravel v8.83.29 release that TuxCare onboarded on 2025-08-25 via commit 838fe2b62d.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-x7p5-p2c9-phvg"
      },
      "impact_statement": "The target Laravel 8.83.29 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability involves unexpected query bindings when array values are passed to query builder methods expecting scalars. All affected methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) already use the flattenValue() helper method to extract scalar values from arrays, which provides the same protection as the upstream patches. This fix was already present in the upstream Laravel v8.83.29 release that TuxCare onboarded on 2025-08-25 via commit 838fe2b62d."
    }
  ]
}