filamentphp vulnerabilities

CVEs per yearBy the year they were published

1. 20242
2. 20251
3. 202611

Newest CVEs

• CVE-2026-104181

  Filament: Multi-factor authentication (app) management actions do not require password reauthentication

  filamentphp · filament

  Medium5.4
• CVE-2026-84307

  Filament: Password validity disclosure for accounts denied panel access on login page

  filamentphp · filament

  Low3.7
• CVE-2026-84306

  Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used

  filamentphp · filament

  Medium6.5
• CVE-2026-77567

  Filament: App-based MFA can be bypassed when recovery codes are enabled

  filamentphp · filament

  High8.1
• CVE-2026-55409

  Filament: Disabled RichEditor field state can be used for XSS

  filamentphp · filament

  High7.6
• CVE-2026-48067

  Filament: Inconsistent scope enforcement for AttachAction and AssociateAction Select fields

  filamentphp · filament

  Medium6.5
• CVE-2026-48167

  Filament: Unvalidated ImageColumn and ImageEntry values can be used for XSS

  filamentphp · filament

  Medium6.4
• CVE-2026-48500

  Filament: Unauthenticated temporary file upload on auth pages

  filamentphp · filament

  Medium6.5
• CVE-2026-48166

  Filament: Timing-based user enumeration on login page

  filamentphp · filament

  Medium5.3
• CVE-2026-48505

  Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission

  filamentphp · filament

  High7.4