A vulnerability in Halyard is being exploited

Attackers are using this flaw in the wild, according to CISA's catalogue of known exploited vulnerabilities. Update today. 12 other new advisories below.

Also

• form-data 4.0.3 · Critical · update to 4.0.4 or later
  form-data uses unsafe random function in form-data for choosing boundary · CVE-2025-7783 · Advisory
• predis/predis 3.2.0 · Critical · update to 3.3.0 or later
  Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections · CVE-2026-84372 · Advisory
• form-data 4.0.3 · High · update to 4.0.6 or later
  form-data: CRLF injection in form-data via unescaped multipart field names and filenames · CVE-2026-12143 · Advisory
• guzzlehttp/guzzle 7.15.1 · High · update to 7.15.2 or later
  Guzzle: Noncanonical host can bypass host-based checks · CVE-2026-69246 · Advisory
• maatwebsite/excel 3.1.67 · High · update to 3.1.70 or later
  Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path · CVE-2026-84374 · Advisory
• vite 7.3.2 · High · update to 7.3.5 or later
  vite: `server.fs.deny` bypass on Windows alternate paths · CVE-2026-53571 · Advisory
• guzzlehttp/guzzle 7.15.1 · Medium · update to 7.15.2 or later
  Guzzle: Noncanonical cookie domain keeps subdomain scope · CVE-2026-69245 · Advisory
• laravel/framework 12.61.0 · Medium · update to 12.61.1 or later
  Laravel Framework: Temporary Signed URL Path Confusion · Advisory
• livewire/livewire 3.6.2 · Medium · fixed after 3.8.2
  Livewire DOM-based cross-site scripting during client-side state handling · CVE-2026-81887 · Advisory
• symfony/http-foundation 7.4.12 · Medium · update to 7.4.13 or later
  IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient · CVE-2026-48736 · Advisory
• vite 7.3.2 · Medium · update to 7.3.5 or later
  launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows · CVE-2026-53632 · Advisory
• laravel/framework 12.61.0 · Low · update to 12.69.0 or later
  Laravel: XSS in Debug Page Information · CVE-2026-102279 · Advisory

You'll hear about each of these once. Run php artisan security-alerts:check to see every open alert.