{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1841e763-158c-5bb8-92a8-1678fcded09f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "type": "library", "group": "laravel", "bom-ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "version": "8.12.2-p5+tuxcare", "pedigree": { "ancestors": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@8.12.2", "type": "library", "group": "laravel", "version": "8.12.2" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-21263", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ], "bom-ref": "urn:uuid:dd640a06-b694-52e3-bb5b-81d8cfe47790", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-21263 is fixed in version 8.12.2-p5+tuxcare of laravel/framework." } }, { "id": "CVE-2021-43617", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ], "bom-ref": "urn:uuid:8b4698b1-a7ba-5208-9abc-b67883c2b371", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.2-p5+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" } }, { "id": "CVE-2021-43808", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ], "bom-ref": "urn:uuid:587f2ccd-d125-5d7e-b4c0-15f9cbe8bed5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-43808 is fixed in version 8.12.2-p5+tuxcare of laravel/framework." } }, { "id": "CVE-2024-52301", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ], "bom-ref": "urn:uuid:0acee0da-d0fd-5db4-b2d0-0c80ed373551", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52301 is fixed in version 8.12.2-p5+tuxcare of laravel/framework." } }, { "id": "CVE-2025-27515", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ], "bom-ref": "urn:uuid:2c187725-e698-5a95-a1ad-cca1420f2523", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27515 is fixed in version 8.12.2-p5+tuxcare of laravel/framework." } }, { "id": "CVE-2026-102279", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ], "bom-ref": "urn:uuid:f354aea8-f757-5887-843f-28b0aa35d5ff", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-102279 does not affect version 8.12.2-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer which uses Tippy.js tooltips with allowHTML: true. Laravel 8.12.2 uses a completely different exception rendering system (Whoops/filp/whoops) that does not include Tippy.js or any JavaScript tooltip functionality. The vulnerable component was introduced in Laravel 11.x+, sever...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-114509", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ], "bom-ref": "urn:uuid:bc7d9407-9eca-55cb-82ab-429494a5449f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114509 affects version 8.12.2-p5+tuxcare of laravel/framework." } }, { "id": "CVE-2026-33347", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ], "bom-ref": "urn:uuid:efec3fbd-7224-5044-814b-fd74f48df3f8", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-33347 is a false positive for laravel/framework 8.12.2-p5+tuxcare. false_positive \u2014 CVE-2026-33347 describes a vulnerability in a Markdown Embed extension with components (DomainFilteringAdapter, OscaroteroEmbedAdapter, EmbedRenderer) that process oEmbed content. This repository is laravel/framework (Laravel PHP web application framework), which does not contain any of these components, does not have embed/oEmbed functionality, and does not depend on the affected embed/embed l..." } }, { "id": "GHSA-4mg9-vhxq-vm7j", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ], "bom-ref": "urn:uuid:db866f9f-76e4-52e2-b84b-f980d7c9a3bc", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.2-p5+tuxcare of laravel/framework." } }, { "id": "GHSA-5vg9-5847-vvmq", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ], "bom-ref": "urn:uuid:6f1730c2-0b19-5664-9464-1450ddbb3d4b", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.2-p5+tuxcare of laravel/framework." } }, { "id": "GHSA-crmm-hgp2-wgrp", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ], "bom-ref": "urn:uuid:a7f619a6-abcb-5708-b06f-add92df01873", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.2-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.2 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in Laravel 12.x's LocalFilesystemAdapter class which provides signed URL functionality for local filesystem storage. This feature does not exist in Laravel 8.12.2, which uses a different architecture where local filesystem adapters cannot generate temporary signed URLs.", "justification": "code_not_present" } }, { "id": "GHSA-jwvj-pwww-3mj5", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ], "bom-ref": "urn:uuid:49f204e2-8772-5d3f-9bb9-d04606285107", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.2-p5+tuxcare of laravel/framework." } }, { "id": "GHSA-wq8p-mqvg-2p5h", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ], "bom-ref": "urn:uuid:c9a88269-61de-5f94-aedc-108514a49129", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.2-p5+tuxcare of laravel/framework." } }, { "id": "GHSA-x7p5-p2c9-phvg", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ], "bom-ref": "urn:uuid:72a80f5b-1a53-543e-8ed1-702024efdfc4", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.2-p5+tuxcare of laravel/framework." } } ], "dependencies": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ] }