CRA Readiness Snapshot
What you would have to assess for ENISA reporting tomorrow
From 11 September 2026, an actively exploited vulnerability in software you ship must be reported to ENISA within 24 hours of awareness (CRA Art. 14). In this snapshot, 3 findings are in the CISA KEV catalog (1 in production dependencies):
| Package | Your version | CVE | Fixed in | Exploit context |
|---|---|---|---|---|
| phpunit/phpunit dev | ^12.5.12 (unpinned) | CVE-2017-9841 | 4.8.28 | KEV listed 2022-02-15 |
| laravel/framework | ^13.17 (unpinned) | CVE-2018-15133 | 5.6.30 | KEV listed 2024-01-16 |
| vite dev | ^8.0.0 (unpinned) | CVE-2025-31125 | 6.2.4 | KEV listed 2026-01-22 |
⚠ No lockfile — SBOM is not reproducible
This scan is based on a manifest (composer.json, package.json), not a lockfile. 14 of 14 dependencies are version ranges, so the exact shipped versions — and their transitive dependencies — cannot be verified. Under the CRA's full obligations (11 December 2027) you must produce a machine-readable SBOM of what you actually ship. Committing a lockfile is the single highest-impact fix in this report.
All findings (51)
| Package | Version | Advisory | Severity | EPSS | Fixed in | Summary |
|---|---|---|---|---|---|---|
| phpunit/phpunit dev | ^12.5.12 | CVE-2017-9841 | KEV CRITICAL | 100.0% | 4.8.28 | Code Injection in PHPUnit |
| laravel/framework | ^13.17 | CVE-2018-15133 | KEV HIGH | 76.8% | 5.6.30 | Laravel Framework RCE Vulnerability |
| vite dev | ^8.0.0 | CVE-2025-31125 | KEV MODERATE | 58.5% | 6.2.4 | Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query |
| vite dev | ^8.0.0 | CVE-2025-30208 | MODERATE | 74.8% | 6.2.3 | Vite bypasses server.fs.deny when using ?raw?? |
| laravel/framework | ^13.17 | CVE-2024-52301 | HIGH | 44.8% | 6.20.45 | Laravel environment manipulation via query string |
| vite dev | ^8.0.0 | CVE-2025-31486 | MODERATE | 40.5% | 6.2.5 | Vite allows server.fs.deny to be bypassed with .svg or relative paths |
| vite dev | ^8.0.0 | CVE-2026-39363 | HIGH | 3.4% | 8.0.5 | Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket |
| vite dev | ^8.0.0 | CVE-2023-34092 | HIGH | 3.1% | 2.9.16 | Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) |
| laravel/framework | ^13.17 | CVE-2020-19316 | HIGH | 2.5% | 5.8.17 | OS Command Injection in Laravel Framework |
| vite dev | ^8.0.0 | CVE-2026-39364 | HIGH | 2.1% | 8.0.5 | Vite: `server.fs.deny` bypassed with queries |
| vite dev | ^8.0.0 | CVE-2025-32395 | MODERATE | 1.7% | 6.2.6 | Vite has an `server.fs.deny` bypass with an invalid `request-target` |
| laravel/framework | ^13.17 | CVE-2021-21263 | HIGH | 1.6% | 8.22.1 | Query Binding Exploitation |
| laravel/framework | ^13.17 | CVE-2017-9303 | MODERATE | 1.3% | 5.4.22 | Laravel does not properly constrain the host portion of a password-reset URL |
| vite dev | ^8.0.0 | CVE-2022-35204 | HIGH | 1.2% | 2.9.13 | Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service |
| vite dev | ^8.0.0 | CVE-2025-58751 | LOW | 1.2% | 7.1.5 | Vite middleware may serve files starting with the same name with the public directory |
| vite dev | ^8.0.0 | CVE-2025-46565 | MODERATE | 1.2% | 6.3.4 | Vite's server.fs.deny bypassed with /. for files under project root |
| laravel/framework | ^13.17 | CVE-2020-24941 | HIGH | 1.1% | 6.18.35 | Improper Input Validation in Laravel |
| vite dev | ^8.0.0 | CVE-2024-45811 | MODERATE | 1.1% | 5.4.6 | Vite's `server.fs.deny` is bypassed when using `?import&raw` |
| laravel/framework | ^13.17 | CVE-2017-14775 | MODERATE | 1.0% | 5.5.10 | Laravel Sensitive Data Exposure |
| vite dev | ^8.0.0 | CVE-2025-62522 | MODERATE | 1.0% | 7.1.11 | vite allows server.fs.deny bypass via backslash on Windows |
| vite dev | ^8.0.0 | CVE-2023-49293 | MODERATE | 1.0% | 4.4.12 | Vite XSS vulnerability in `server.transformIndexHtml` via URL payload |
| vite dev | ^8.0.0 | CVE-2026-39365 | MODERATE | 0.9% | 8.0.5 | Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling |
| laravel/framework | ^13.17 | CVE-2021-43808 | MODERATE | 0.8% | 6.20.42 | Laravel Framework XSS in Blade templating engine |
| vite dev | ^8.0.0 | CVE-2024-23331 | HIGH | 0.8% | 2.9.17 | Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem |
| laravel/framework | ^13.17 | CVE-2025-27515 | MODERATE | 0.7% | 12.1.1 | Laravel has a File Validation Bypass |
| vite dev | ^8.0.0 | CVE-2024-31207 | MODERATE | 0.7% | 2.9.18 | Vite's `server.fs.deny` did not deny requests for patterns with directories. |
| vite dev | ^8.0.0 | CVE-2024-45812 | MODERATE | 0.6% | 5.4.6 | Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS |
| vite dev | ^8.0.0 | CVE-2025-58752 | LOW | 0.6% | 7.1.5 | Vite's `server.fs` settings were not applied to HTML files |
| laravel/framework | ^13.17 | CVE-2024-13918 | MODERATE | 0.6% | 11.36.0 | Laravel framework susceptible to reflected cross-site scripting |
| vite dev | ^8.0.0 | CVE-2026-53571 | HIGH | 0.6% | 8.0.16 | vite: `server.fs.deny` bypass on Windows alternate paths |
+ 21 further findings (mostly lower severity) — available in the full export.
SBOM summary
14 direct dependencies scanned (0 pinned to exact versions) from composer.json, package.json. Vulnerability data: OSV.dev · exploitation status: CISA KEV · exploit probability: FIRST EPSS. Findings on unpinned dependencies cover the full constraint range and may not apply to the exact version deployed.
Using ENISA's CRA Maturity Assessment Model for SMEs? This snapshot provides evidence for the Vulnerability Management domain and the product-level technical documentation question (1.3) under Governance & Documentation.
This snapshot is an automated readiness assessment, not legal advice and not a conformity assessment under the CRA.