Login Request a demo
FI
Product
filament
by filamentphp · last CVE Oct 1, 2026
14
CVEs
0
On KEV
8.1
Max CVSS
1
New 30D
Vulnerabilities14In the news0Timeline
Severity mix
Critical 0High 4Medium 8Low 2
Severity
All severities14Critical0High4Medium8Low2
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add filament to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-77567
8.1
1%
Aug 24
Filament: App-based MFA can be bypassed when recovery codes are enabled
Affected: >= 4.0.0, < 4.12.0; >= 5.0.0, < 5.7.0
CVE-2025-67507
8.1
0%
Dec 10
Filament's multi-factor authentication (app) recovery codes can be used multiple times
Affected: >= 4.0.0, < 4.3.1
CVE-2026-55409
7.6
0%
Jun 22
Filament: Disabled RichEditor field state can be used for XSS
Affected: >= 3.0.0, < 3.3.53
CVE-2026-48505
7.4
0%
Jun 22
Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission
Affected: >= 4.0.0, < 4.11.5; >= 5.0.0, < 5.6.5
CVE-2026-84306
6.5
0%
Sep 1
Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used
Affected: >= 4.0.0, < 4.12.6; >= 5.0.0, < 5.7.6
CVE-2026-48067
6.5
0%
Jun 22
Filament: Inconsistent scope enforcement for AttachAction and AssociateAction Select fields
Affected: >= 4.0.0, < 4.11.4; >= 5.0.0, < 5.6.4; >= 3.0.0, < 3.3.51
CVE-2026-48500
6.5
0%
Jun 22
Filament: Unauthenticated temporary file upload on auth pages
Affected: >= 3.0.0, < 3.3.52; >= 5.0.0, < 5.6.5; >= 4.0.0, < 4.11.5
CVE-2026-48167
6.4
0%
Jun 22
Filament: Unvalidated ImageColumn and ImageEntry values can be used for XSS
Affected: >= 4.0.0, < 4.11.5; >= 5.0.0, < 5.6.5
CVE-2024-47186
6.1
0%
Sep 27
Filament has unvalidated ColorColumn and ColorEntry values that can be used for Cross-site Scripting
Affected: >= 3.0.0, < 3.2.115
CVE-2026-104181
5.4
0%
Oct 1
Filament: Multi-factor authentication (app) management actions do not require password reauthentication
Affected: >= 4.0.0, < 4.13.2; >= 5.0.0, < 5.8.2
CVE-2026-33080
5.4
0%
Mar 20
Filament: Unvalidated Range and Values summarizer values can be used for XSS
Affected: >= 4.0.0, < 4.8.5; >= 5.0.0, < 5.3.5
CVE-2026-48166
5.3
0%
Jun 22
Filament: Timing-based user enumeration on login page
Affected: >= 4.0.0, < 4.11.5; >= 5.0.0, < 5.6.5
CVE-2026-84307
3.7
0%
Sep 1
Filament: Password validity disclosure for accounts denied panel access on login page
Affected: >= 4.0.0, < 4.12.5; >= 5.0.0, < 5.7.5
CVE-2024-51758
2.3
1%
Nov 7
Exported files stored in default (`public`) filesystem if not reconfigured in filament
Affected: >= 3.2.0, < 3.2.123
Showing 14