Login Request a demo
FI
Product
filament
by filamentphp · last CVE Oct 1, 2026
14
CVEs
0
On KEV
8.1
Max CVSS
1
New 30D
Vulnerabilities14In the news0Timeline
Severity mix
Critical 0High 4Medium 8Low 2
Severity
All severities14Critical0High4Medium8Low2
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add filament to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-84306
6.5
0%
Sep 1
Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used
Affected: >= 4.0.0, < 4.12.6; >= 5.0.0, < 5.7.6
CVE-2026-48067
6.5
0%
Jun 22
Filament: Inconsistent scope enforcement for AttachAction and AssociateAction Select fields
Affected: >= 4.0.0, < 4.11.4; >= 5.0.0, < 5.6.4; >= 3.0.0, < 3.3.51
CVE-2026-48500
6.5
0%
Jun 22
Filament: Unauthenticated temporary file upload on auth pages
Affected: >= 3.0.0, < 3.3.52; >= 5.0.0, < 5.6.5; >= 4.0.0, < 4.11.5
CVE-2026-48167
6.4
0%
Jun 22
Filament: Unvalidated ImageColumn and ImageEntry values can be used for XSS
Affected: >= 4.0.0, < 4.11.5; >= 5.0.0, < 5.6.5
CVE-2024-47186
6.1
0%
Sep 27
Filament has unvalidated ColorColumn and ColorEntry values that can be used for Cross-site Scripting
Affected: >= 3.0.0, < 3.2.115
CVE-2026-104181
5.4
0%
Oct 1
Filament: Multi-factor authentication (app) management actions do not require password reauthentication
Affected: >= 4.0.0, < 4.13.2; >= 5.0.0, < 5.8.2
CVE-2026-33080
5.4
0%
Mar 20
Filament: Unvalidated Range and Values summarizer values can be used for XSS
Affected: >= 4.0.0, < 4.8.5; >= 5.0.0, < 5.3.5
CVE-2026-48166
5.3
0%
Jun 22
Filament: Timing-based user enumeration on login page
Affected: >= 4.0.0, < 4.11.5; >= 5.0.0, < 5.6.5
Showing 8