{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:abe0cb62-73f9-5579-abf9-479189dbe660", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "type": "library", "group": "laravel", "bom-ref": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "version": "8.12.3-p5+tuxcare", "pedigree": { "ancestors": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@8.12.3", "type": "library", "group": "laravel", "version": "8.12.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-21263", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } ], "bom-ref": "urn:uuid:026b740b-17f9-5f23-b357-6e8949fb3d31", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-21263 is fixed in version 8.12.3-p5+tuxcare of laravel/framework." } }, { "id": "CVE-2021-43617", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } ], "bom-ref": "urn:uuid:457b1482-e0f7-58c0-a8bc-a8dd0d3743c6", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.3-p5+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" } }, { "id": "CVE-2021-43808", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } ], "bom-ref": "urn:uuid:f7be298f-92fd-5507-92a0-8b0671060139", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-43808 is fixed in version 8.12.3-p5+tuxcare of laravel/framework." } }, { "id": "CVE-2024-52301", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } ], "bom-ref": "urn:uuid:0887b2a7-3488-56ca-8f85-2eb3b0517450", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52301 is fixed in version 8.12.3-p5+tuxcare of laravel/framework." } }, { "id": "CVE-2025-27515", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } ], "bom-ref": "urn:uuid:cc21ab26-4559-59a4-8c3d-9ba3ef145fdb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27515 is fixed in version 8.12.3-p5+tuxcare of laravel/framework." } }, { "id": "CVE-2026-102279", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } ], "bom-ref": "urn:uuid:5b7c36a3-253f-57dc-a83c-ba3672a556d1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-102279 does not affect version 8.12.3-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-102279. The vulnerability requires Laravel's modern exception renderer with Tippy.js tooltips (introduced in Laravel 11+), which does not exist in Laravel 8.12.3. This version uses the Whoops library (filp/whoops) for debug mode exception rendering and simple static HTML templates for error pages. No Tippy.js dependency, no interactive tooltips, and no...", "justification": "code_not_present" } }, { "id": "CVE-2026-114509", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } ], "bom-ref": "urn:uuid:7047a38f-4ff8-5d6f-a673-af27b2b9fdbb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114509 affects version 8.12.3-p5+tuxcare of laravel/framework." } }, { "id": "GHSA-4mg9-vhxq-vm7j", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } ], "bom-ref": "urn:uuid:56c4e732-d0b7-54b7-988b-6a57de4e7aae", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.3-p5+tuxcare of laravel/framework." } }, { "id": "GHSA-5vg9-5847-vvmq", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } ], "bom-ref": "urn:uuid:9c57ce44-a212-5495-8f75-20bc51239f15", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.3-p5+tuxcare of laravel/framework." } }, { "id": "GHSA-crmm-hgp2-wgrp", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } ], "bom-ref": "urn:uuid:08a8ed73-59ea-5ace-8a2a-3e197ade1a22", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.3-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 does not implement local filesystem temporary signed URLs. The vulnerability targets LocalFilesystemAdapter::temporaryUrl() which was introduced in Laravel 10+. In Laravel 8.x, calling temporaryUrl() on local filesystem throws RuntimeException, preventing the attack chain from completing.", "justification": "code_not_present" } }, { "id": "GHSA-jwvj-pwww-3mj5", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } ], "bom-ref": "urn:uuid:71e3df61-4af3-5d1c-9348-dbf249406d91", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.3-p5+tuxcare of laravel/framework." } }, { "id": "GHSA-wq8p-mqvg-2p5h", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } ], "bom-ref": "urn:uuid:d1500c36-056c-5560-951d-31bb699410a9", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.3-p5+tuxcare of laravel/framework." } }, { "id": "GHSA-x7p5-p2c9-phvg", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } ], "bom-ref": "urn:uuid:0f31e459-5392-59a1-8aca-267b87d5dc12", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.3-p5+tuxcare of laravel/framework." } } ], "dependencies": [ { "ref": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } ] }