Filamentphp Filament vulnerabilities

• filamentphp filament Filament: Multi-factor authentication (app) management actions do not require password reauthentication CVE-2026-104181 Fix available 5.4 MediumOctober 1, 2026
• filamentphp filament Filament: Password validity disclosure for accounts denied panel access on login page CVE-2026-84307 Fix available 3.7 LowSeptember 1, 2026
• filamentphp filament Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used CVE-2026-84306 Fix available 6.5 MediumSeptember 1, 2026
• filamentphp filament Filament: App-based MFA can be bypassed when recovery codes are enabled CVE-2026-77567 Fix available 8.1 HighAugust 24, 2026
• filamentphp filament Filament: Unvalidated ImageColumn and ImageEntry values can be used for XSS CVE-2026-48167 Fix available 6.4 MediumJune 22, 2026
• filamentphp filament Filament: Unauthenticated temporary file upload on auth pages CVE-2026-48500 Public exploitFix available 6.5 MediumJune 22, 2026
• filamentphp filament Filament: Timing-based user enumeration on login page CVE-2026-48166 Fix available 5.3 MediumJune 22, 2026
• filamentphp filament Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission CVE-2026-48505 Fix available 7.4 HighJune 22, 2026
• filamentphp filament Filament: Disabled RichEditor field state can be used for XSS CVE-2026-55409 Fix available 7.6 HighJune 17, 2026
• filamentphp filament Filament: Inconsistent scope enforcement for AttachAction and AssociateAction Select fields CVE-2026-48067 Fix available 6.5 MediumJune 11, 2026
• filamentphp filament Filament: Unvalidated Range and Values summarizer values can be used for XSS CVE-2026-33080 Fix available 7.3 HighMarch 18, 2026
• filamentphp filament Filament's multi-factor authentication (app) recovery codes can be used multiple times CVE-2025-67507 Fix available 8.1 HighDecember 9, 2025
• filamentphp filament, filament excel export +1 more Exported files stored in default (`public`) filesystem if not reconfigured in filament CVE-2024-51758 Fix available 2.3 LowNovember 7, 2024
• filamentphp filament Filament has unvalidated ColorColumn and ColorEntry values that can be used for Cross-site Scripting CVE-2024-47186 Fix available 6.1 MediumSeptember 27, 2024