filament has 9 CVEs on record. Cadence is steady at roughly 4 per quarter. The busiest recent month was June 2026 with 6. The median CVSS is 6.5 (medium). None have a confirmed exploitation report. Most affected products: filament/filament (6), filament/forms (1), filament/infolists (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 4 prev 5
Products
- filament/filament 6
- filament/forms 1
- filament/infolists 1
- filament/tables 1
Worst active — by depth score
CVE-2026-77567High· 8.1Filament is a collection of full-stack components for accelerated Laravel development45CVE-2026-55409High· 7.6Filament: Disabled RichEditor field state can be used for XSS42CVE-2026-48505High· 7.4Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission41CVE-2026-84306Medium· 6.5Filament is a collection of full-stack components for accelerated Laravel development36CVE-2026-48500Medium· 6.5Filament: Unauthenticated temporary file upload on auth pages36
filament vulnerabilities
CVEs affecting filament, newest first. Open any entry for full detail, references, and exploit status.
9 CVEsRSS
CVE-2026-84307Low· 3.7Filament is a collection of full-stack components for accelerated Laravel development
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login.php presents the multi-factor authentication challenge before evaluating canAc…
CVE-2026-84306Medium· 6.5Filament is a collection of full-stack components for accelerated Laravel development
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.6 and 5.7.6, packages/panels/src/Auth/MultiFactor/App/AppAuthentication.php uses AppAuthentication::verifyCode() with a used-cod…
CVE-2026-77567High· 8.1Filament is a collection of full-stack components for accelerated Laravel development
Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when …
CVE-2026-48505High· 7.4Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission
Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission
CVE-2026-48166Medium· 5.3Filament: Timing-based user enumeration on login page
Filament: Timing-based user enumeration on login page
CVE-2026-48167Medium· 6.4Filament: Unvalidated ImageColumn and ImageEntry values can be used for XSS
Filament: Unvalidated ImageColumn and ImageEntry values can be used for XSS
CVE-2026-48500Medium· 6.5Filament: Unauthenticated temporary file upload on auth pages
Filament: Unauthenticated temporary file upload on auth pages
CVE-2026-55409High· 7.6Filament: Disabled RichEditor field state can be used for XSS
Filament: Disabled RichEditor field state can be used for XSS
CVE-2026-48067Medium· 6.5Filament has inconsistent scope enforcement for its AttachAction and AssociateAction Select fields
Filament has inconsistent scope enforcement for its AttachAction and AssociateAction Select fields