Laravel Livewire — known CVE vulnerabilities

Every CVE whose affected-product data names Laravel Livewire, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (4)

• CVE-2024-47823 — CVSS 9.8 (critical): Livewire is a full-stack framework for Laravel that allows for dynamic UI components without leaving PHP. In livewire/livewire prior to…
• CVE-2025-54068 — CVSS 9.8 (critical) — actively exploited: Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers…
• CVE-2024-22859 — CVSS 8.8 (high): Cross-Site Request Forgery (CSRF) vulnerability in livewire before v3.0.4, allows remote attackers to execute arbitrary code getCsrfToken…
• CVE-2024-21504 — CVSS 6.1 (medium): Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS) when a page uses [Url]…