CLSA-2026-1790868699 TuxCare security update for livewire/livewire (1 CVE)

TuxCare rebuilt livewire/livewire to address 1 CVE. Fixed in v3.6.4-p1+tuxcare...

CLSA-2026-1790868445 TuxCare security update for livewire/livewire (1 CVE)

TuxCare rebuilt livewire/livewire to address 1 CVE. Fixed in v3.6.3-p2+tuxcare...

PT-2026-110294

TuxCare rebuilt livewire/livewire to address 1 CVE. Fixed in 3.6.3-p2+tuxcare...

PT-2026-110297

TuxCare rebuilt livewire/livewire to address 1 CVE. Fixed in v3.6.4-p1+tuxcare...

Prototype Pollution

Overview livewire/livewire is an A front-end framework for Laravel. Affected versions of this package are vulnerable to Prototype Pollution in the client-side state handling process. An attacker can execute arbitrary JavaScript in the context of the affected application by tricking a user into...

PT-2026-73601

TuxCare rebuilt livewire/livewire to address 1 CVE. Fixed in 3.6.3-p1+tuxcare...

CVE-2024-21504

Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting XSS when a page uses Url for a property. An attacker can inject HTML code in the context of the user's browser session by crafting a malicious link and convincing the user to click on it...

PT-2024-40442

Name of the Vulnerable Software and Affected Versions livewire/livewire versions 2.2.5 Description The issue is related to a data leakage problem. The $this-validate method was returning all properties of the Livewire component, instead of only the validated dataset. This introduced a security...

Cross-site Scripting in livewire/livewire

Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting XSS when a page uses Url for a property. An attacker can inject HTML code in the context of the user's browser session by crafting a malicious link and convincing the user to click on it...

CVE-2024-21504

CVE-2024-21504 affects livewire/livewire up to 3.4.9. The vulnerability is a Cross-site Scripting (XSS) flaw when a page uses [Url] for a property, allowing an attacker to inject HTML in a user’s browser via a crafted link. Remediation: upgrade to 3.4.9 or later (Livewire release notes and adviso...

CVE-2024-21504

Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting XSS when a page uses Url for a property. An attacker can inject HTML code in the context of the user's browser session by crafting a malicious link and convincing the user to click on it...

CVE-2024-21504

Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting XSS when a page uses Url for a property. An attacker can inject HTML code in the context of the user's browser session by crafting a malicious link and convincing the user to click on it...

CVE-2024-21504

Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting XSS when a page uses Url for a property. An attacker can inject HTML code in the context of the user's browser session by crafting a malicious link and convincing the user to click on it...

CVE-2024-21504: Improper Neutralization of Input During Web Page Generation

Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting XSS when a page uses Url for a property. An attacker can inject HTML code in the context of the user's browser session by crafting a malicious link and convincing the user to click on it...