Five vulnerabilities reported against a stock install (Laravel 13, Livewire 4):
account takeover inside a tenant from the company user modal, privilege escalation to
the admin role from the users page, a known password on the seeded admin, and two stored
XSS sinks (a display name in select-list, a rich-text value).

After updating: change the password of admin@laravel (or delete the account) and review
user names / rich-text values that contain markup. An account that is not a super admin
and not the owner of its company now edits only itself from the company page.