6.5Medium

CVE-2020-36950Laravel Nova 3.7.0 - 'range' DoS

Laravel Holdings Inc. Laravel Nova Published: 2026-01-27 18:23 (9 months ago)

Description

Laravel Nova 3.7.0 contains a denial of service vulnerability that allows authenticated users to crash the application by manipulating the 'range' parameter. Attackers can send simultaneous requests with an extremely high range value to overwhelm and crash the server.

Weakness (CWE): CWE-770

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
laravel	laravel	3.7.0
Laravel Holdings Inc.	Laravel Nova	3.7.0

References and patches

ExploitDB-49198 exploit
Laravel Nova Official Homepage product
Laravel Nova Releases Page patch
VulnCheck Advisory: Laravel Nova 3.7.0 - 'range' DoS third-party-advisory

CVSS score

6.5Medium

Source: VulnCheck · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

All scores (4)

cna	CVSS 4.0	8.7High
cna	CVSS 3.1	6.5Medium
disclosure@vulncheck.com	CVSS 4.0	8.7High
disclosure@vulncheck.com	CVSS 3.1	6.5Medium

EPSS (chance of exploitation in 30 days)

0.38%

higher than 32% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: yes
Technical impact: partial

Timeline

ID reserved2026-01-25
Published2026-01-27 18:23
Reached IP-DB2026-10-25 00:05
Last updated2026-08-14 19:49

Assigned by (CNA): VulnCheck
NVD status: Deferred

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Laravel

2.3Low

CVE-2026-128083 21 hours ago

Laravel: Task Output Injection - Concurrency Process

laravel framework

Laravel is a web application framework. Prior to 12.71.0 and 13.40.0, Laravel's Concurrency::run process driver can treat a forged internal result message in child standard output as framework output. An application route must invoke Concurrency::run, and a t…

9.2Critical

CVE-2026-114509 23 days ago

Laravel TokenGuard authentication bypass through non-string API credentials

laravel framework

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can matc…

1.8%EPSS

6.5Medium

CVE-2026-114508 23 days ago

Laravel relationship inclusion can trigger unauthorized data destruction

laravel framework

Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no w…

3.1Low

CVE-2026-102279 1 month ago

Laravel: XSS in Debug Page Information

laravel framework

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user ho…

8.9High

CVE-2026-48019 2 months ago

CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay

laravel framework

Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticat…

8.4High

CVE-2021-47756 10 months ago

Laravel Valet 2.0.3 - Local Privilege Escalation (macOS)

Laravel Laravel Valet

Laravel Valet versions 1.1.4 to 2.0.3 contain a local privilege escalation vulnerability that allows users to modify the valet command with root privileges. Attackers can edit the symlinked valet command to execute arbitrary code with root permissions without…