{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:77c1b726-9c12-5250-8bed-a97f3baa0269", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "type": "library", "group": "laravel", "bom-ref": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "version": "8.12.0-p7+tuxcare", "pedigree": { "ancestors": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@8.12.0", "type": "library", "group": "laravel", "version": "8.12.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-21263", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } ], "bom-ref": "urn:uuid:a25c0ff2-e1d6-5ce8-b86f-618cfa25abbe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-21263 is fixed in version 8.12.0-p7+tuxcare of laravel/framework." } }, { "id": "CVE-2021-43617", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } ], "bom-ref": "urn:uuid:6bf0096a-cf5a-532e-8312-6801ba64795d", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.0-p7+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" } }, { "id": "CVE-2021-43808", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } ], "bom-ref": "urn:uuid:0ca29974-9b59-58c9-bcec-9ae9710b3b3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-43808 is fixed in version 8.12.0-p7+tuxcare of laravel/framework." } }, { "id": "CVE-2024-52301", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } ], "bom-ref": "urn:uuid:e582d084-b5fe-5017-b5b2-43895b50db59", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52301 is fixed in version 8.12.0-p7+tuxcare of laravel/framework." } }, { "id": "CVE-2025-27515", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } ], "bom-ref": "urn:uuid:142a4755-8a87-541f-b16f-ca676d49980c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27515 is fixed in version 8.12.0-p7+tuxcare of laravel/framework." } }, { "id": "CVE-2026-102279", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } ], "bom-ref": "urn:uuid:259659b2-bbf1-54d3-a0d5-793f1745065e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-102279 does not affect version 8.12.0-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's modern exception renderer (introduced in Laravel 11.x+) that uses Tippy.js tooltips with allowHTML:true. Laravel 8.12.0 uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture. The vulnerable components (formatted-source.blade.php, renderer/scripts.js, Ti...", "justification": "code_not_present" } }, { "id": "CVE-2026-114509", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } ], "bom-ref": "urn:uuid:10af484e-2c76-53a4-8caf-3bed23be8d81", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114509 affects version 8.12.0-p7+tuxcare of laravel/framework." } }, { "id": "CVE-2026-33347", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } ], "bom-ref": "urn:uuid:e0156826-8b0d-5abb-a150-6da1ccb4444e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-33347 does not affect version 8.12.0-p7+tuxcare of laravel/framework. CVE-2026-33347 in league/commonmark 1.6.7 is not affected. Refer to league/commonmark 1.6.7 for details.", "justification": "requires_dependency" } }, { "id": "GHSA-4mg9-vhxq-vm7j", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } ], "bom-ref": "urn:uuid:6aea2be4-e70d-5bcf-8090-cc836b1da7d8", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.0-p7+tuxcare of laravel/framework." } }, { "id": "GHSA-5vg9-5847-vvmq", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } ], "bom-ref": "urn:uuid:5aa511b5-9a67-53b6-8b8b-88a061e16653", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.0-p7+tuxcare of laravel/framework." } }, { "id": "GHSA-crmm-hgp2-wgrp", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } ], "bom-ref": "urn:uuid:bde1eefc-e502-5197-813f-78456659468e", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.0-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0-p3+tuxcare does not have the vulnerable LocalFilesystemAdapter class or local filesystem temporary URL generation feature. The vulnerability exists in Laravel 11+ where LocalFilesystemAdapter was introduced. The target version uses FilesystemAdapter which explicitly rejects temporary URL generation for local filesystem adapters with a RuntimeException.", "justification": "code_not_present" } }, { "id": "GHSA-jwvj-pwww-3mj5", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } ], "bom-ref": "urn:uuid:7a30e7ff-b941-5d25-a0a3-649284b66662", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.0-p7+tuxcare of laravel/framework." } }, { "id": "GHSA-wq8p-mqvg-2p5h", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } ], "bom-ref": "urn:uuid:c7997357-6067-5e81-a2d8-0acfe934bef2", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.0-p7+tuxcare of laravel/framework." } }, { "id": "GHSA-x7p5-p2c9-phvg", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } ], "bom-ref": "urn:uuid:52a74c90-9fb0-573b-91da-12348c4a8c17", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.0-p7+tuxcare of laravel/framework." } } ], "dependencies": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } ] }