filamentphp filament vulnerabilities

13 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 12 published in the last 12 months.

Latest filamentphp filament vulnerabilities

CVE-2026-104181 — Filament: Multi-factor authentication (app) management actions do not require password reauthentication (CVSS 5.4)
CVE-2026-84307 — Filament: Password validity disclosure for accounts denied panel access on login page (CVSS 3.7)
CVE-2026-84306 — Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used (CVSS 6.5)
CVE-2026-77567 — Filament: App-based MFA can be bypassed when recovery codes are enabled (CVSS 8.1)
CVE-2026-55409 — Filament: Disabled RichEditor field state can be used for XSS (CVSS 7.6)
CVE-2026-48505 — Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission (CVSS 7.4)
CVE-2026-48500 — Filament: Unauthenticated temporary file upload on auth pages (CVSS 6.5)
CVE-2026-48167 — Filament: Unvalidated ImageColumn and ImageEntry values can be used for XSS (CVSS 6.4)
CVE-2026-48166 — Filament: Timing-based user enumeration on login page (CVSS 5.3)
CVE-2026-48067 — Filament: Inconsistent scope enforcement for AttachAction and AssociateAction Select fields (CVSS 6.5)
CVE-2026-33080 — Filament: Unvalidated Range and Values summarizer values can be used for XSS (CVSS 5.4)
CVE-2025-67507 — Filament's multi-factor authentication (app) recovery codes can be used multiple times (CVSS 8.1)
CVE-2024-47186 — Filament has unvalidated ColorColumn and ColorEntry values that can be used for Cross-site Scripting (CVSS 6.1)