filament/filament vulnerabilities
CVEs whose affected-version data names the filament/filament package (composer). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
6 CVEsRSS
CVE-2026-84307Low· 3.7Filament is a collection of full-stack components for accelerated Laravel development
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login.php presents the multi-factor authentication challenge before evaluating canAc…
CVE-2026-84306Medium· 6.5Filament is a collection of full-stack components for accelerated Laravel development
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.6 and 5.7.6, packages/panels/src/Auth/MultiFactor/App/AppAuthentication.php uses AppAuthentication::verifyCode() with a used-cod…
CVE-2026-77567High· 8.1Filament is a collection of full-stack components for accelerated Laravel development
Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when …
CVE-2026-48505High· 7.4Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission
Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission
CVE-2026-48166Medium· 5.3Filament: Timing-based user enumeration on login page
Filament: Timing-based user enumeration on login page
CVE-2026-48500Medium· 6.5PoCFilament: Unauthenticated temporary file upload on auth pages
Filament: Unauthenticated temporary file upload on auth pages