Ffilamentphp

Products

Exploited and recent CVEs

• CVE-2026-104181 Medium 5.4 Filament: Multi-factor authentication (app) management actions do not require password reauthentication 0.3%
• CVE-2026-84307 Low 3.7 Filament: Password validity disclosure for accounts denied panel access on login page 0.5%
• CVE-2026-84306 Medium 6.5 Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used 0.4%
• CVE-2026-77567 High 8.1 Filament: App-based MFA can be bypassed when recovery codes are enabled 0.6%
• CVE-2026-55409 High 7.6 Filament: Disabled RichEditor field state can be used for XSS 0.4%
• CVE-2026-48067 Medium 6.5 Filament: Inconsistent scope enforcement for AttachAction and AssociateAction Select fields 0.3%
• CVE-2026-48167 Medium 6.4 Filament: Unvalidated ImageColumn and ImageEntry values can be used for XSS 0.2%
• CVE-2026-48500 Medium 6.5 Filament: Unauthenticated temporary file upload on auth pages 0.3%
• CVE-2026-48166 Medium 5.3 Filament: Timing-based user enumeration on login page 0.3%
• CVE-2026-48505 High 7.4 Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission 0.3%
• CVE-2026-33080 High 7.3 Filament: Unvalidated Range and Values summarizer values can be used for XSS 0.3%
• CVE-2025-67507 High 8.1 Filament's multi-factor authentication (app) recovery codes can be used multiple times 0.3%
• CVE-2024-51758 Low 2.3 Exported files stored in default (`public`) filesystem if not reconfigured in filament 0.6%
• CVE-2024-47186 Medium 6.1 Filament has unvalidated ColorColumn and ColorEntry values that can be used for Cross-site Scripting 0.4%