These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-105130 is a race condition vulnerability in LaraDashboard versions 1.4.0 through 1.4.7. The vulnerability allows unauthenticated attackers to bypass the per-IP daily registration limit by sending concurrent registration requests from a single IP address. This could lead to unauthorized account creation and bypassing of anti-automation controls, potentially increasing spam or malicious activity. D [truncated]
CVE-2026-105129 is an incorrect authorization vulnerability in LaraDashboard before version 1.4.8. Authenticated users with only settings.view permission can read stored secrets through the settings API. This allows attackers to query GET /api/settings or /api/settings/{option_name} to retrieve plaintext AI provider API keys, mail credentials, passwords, and tokens.
CVE-2026-105128 is an open redirect vulnerability in LaraDashboard before version 1.4.8. The vulnerability allows remote attackers to redirect users by supplying an unvalidated redirect_url parameter to EmailTemplateController builder and builderEdit. Attackers can send crafted builder links to logged-in users with email template permissions, causing them to navigate to attacker-controlled phishing sites [truncated]
CVE-2026-105127 is a vulnerability in LaraDashboard 1.4.2 before 1.4.8 that allows unauthenticated attackers to exhaust the verification quota for email validation, potentially making validation fail open for all public forms and allowing probing of domain resolution. This vulnerability is caused by the application of advanced email validation to unauthenticated forgot-password and reset-password requests [truncated]
CVE-2026-105126 is a high-severity vulnerability in LaraDashboard before version 1.4.8, allowing authenticated Admin users to escalate privileges to Superadmin by editing or renaming roles. This could enable attackers with role.edit permissions to rename their role to Superadmin or grant user.login_as permissions, potentially leading to code execution through core upgrade and module installation functions.
CVE-2026-105125 is a path traversal vulnerability in LaraDashboard before version 1.4.8. The vulnerability allows unauthenticated attackers to read JSON files by manipulating the {lang} route segment. On Windows hosts, attackers can send URL-encoded backslash sequences to escape resources/lang and read application JSON files. Defenders should prioritize verifying exposure of LaraDashboard instances, espec [truncated]
CVE-2026-90933 is a missing authorization vulnerability in laradashboard through 1.2.2, affecting Local License API endpoints. Authenticated users can read, overwrite, and delete premium module license keys via specific API endpoints. The vulnerability allows low-privileged accounts to access GET /api/admin/licenses/show, POST /api/admin/licenses/store, and POST /api/admin/licenses/remove endpoints, poten [truncated]
CVE-2026-90932 is a path traversal vulnerability in LaraDashboard versions 0.9.2 through 1.2.2. An authenticated user with the delegated settings.edit permission can supply ../ traversal sequences to delete arbitrary files reachable on the host filesystem or restore a ZIP archive from an arbitrary on-disk location, achieving remote code execution. The vulnerability is caused by the insecure concatenation [truncated]
CVE-2026-90931 is a medium-severity vulnerability in LaraDashboard that allows authenticated users to upload malicious SVG files, leading to stored XSS and potential session hijacking or administrative account takeover. The vulnerability affects LaraDashboard versions 0.9.0 through 1.2.2 and is exploitable by users with media.create permission. Defenders should prioritize verification, patching, and mitig [truncated]
CVE-2026-86438 debrief based on the supplied source corpus. The CVE record was published on 2026-09-07T22:17:22.163Z and has not been modified since then. This vulnerability affects Lara Dashboard installations prior to version 1.3.2, allowing non-Superadmin administrators to install arbitrary PHP modules via the MarketplaceModuleBrowser installModule Livewire action, potentially leading to remote code ex [truncated]
CVE-2026-86437 debrief: Lara Dashboard before 1.3.2 has a vulnerability in the POST /admin/settings/core-upgrades/upload endpoint, allowing non-Superadmin administrators with settings.edit permission to upload and extract arbitrary zip archives over the live application source code. This could lead to potential code execution and unauthorized access. Defenders should assess exposure and apply remediation, [truncated]
CVE-2026-86436 debrief based on the supplied source corpus. The CVE record was published on 2026-09-07T22:17:21.833Z and has not been modified since then. This medium-severity vulnerability in Lara Dashboard allows unauthorized file uploads, potentially leading to code execution. Defenders should assess exposure, especially in publicly accessible deployments, and prioritize remediation. The vulnerability [truncated]
