PT-2026-91258

parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenticated panel users to inject malicious scripts. Attackers can store XSS payloads in comment bodies that execute in the browsers of other users viewing those...

CVE-2026-56826

Four Livewire components in the Settings area expose destructive Filament actions "delete" / "edit" that perform no server-side authorization. Any authenticated user who can reach the Settings pages — i.e. holding only the coarse "accesssetting" permission, without being an admin and without any...

Shopping privilege escalation through missing authorization in Settings components

Summary Four Livewire components in the Settings area expose destructive Filament actions delete / edit that perform no server-side authorization. Any authenticated user who can reach the Settings pages — i.e. holding only the coarse accesssetting permission, without being an admin and without an...

GHSA-F7H9-QV4X-9X57 Shopping privilege escalation through missing authorization in Settings components

Summary Four Livewire components in the Settings area expose destructive Filament actions delete / edit that perform no server-side authorization. Any authenticated user who can reach the Settings pages — i.e. holding only the coarse accesssetting permission, without being an admin and without an...

GHSA-243P-F3CV-C5WH Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers

Summary Five Filament groupedBulkActions blocks across the Shopper admin Livewire pages omit the -authorize... permission gate, while their per-record sibling actions and other Shopper Index pages such as Pages/Settings/Currencies.php, Pages/Reviews/Index.php, Pages/Collection/Index.php, and...

Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers

Summary Five Filament groupedBulkActions blocks across the Shopper admin Livewire pages omit the -authorize... permission gate, while their per-record sibling actions and other Shopper Index pages such as Pages/Settings/Currencies.php, Pages/Reviews/Index.php, Pages/Collection/Index.php, and...

PT-2026-90543

Summary Five Filament groupedBulkActions blocks across the Shopper admin Livewire pages omit the -authorize... permission gate, while their per-record sibling actions and other Shopper Index pages such as Pages/Settings/Currencies.php, Pages/Reviews/Index.php, Pages/Collection/Index.php, and...

PT-2026-90542

Name of the Vulnerable Software and Affected Versions Shopper versions 2.0.0 through 2.9.1 Description Authenticated users with the access setting permission can perform unauthorized destructive actions via the Livewire endpoint. This occurs because four Livewire components in the Settings area d...

AppAuthentication::verifyCode() MultiFactor Auth Bypass

The vulnerability of the AppAuthentication::verifyCode method in the packages/panels/src/Auth/MultiFactor/App/AppAuthentication.php file of the Filament PHP framework’s Laravel set is related to the possibility of bypassing the authentication process. Exploiting this vulnerability could allow an...

Malicious Package

Overview bellatrix-websockets-filament-biohacking is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organizati...

Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used

A flaw in the handling of one-time codes for app-based multi-factor authentication allows a previously issued code to be used after a newer code has already been accepted. This issue does not affect email-based MFA. Submitting the exact same code twice was already prevented, but any other code...

GHSA-R3J6-GPJW-QFJR Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used

A flaw in the handling of one-time codes for app-based multi-factor authentication allows a previously issued code to be used after a newer code has already been accepted. This issue does not affect email-based MFA. Submitting the exact same code twice was already prevented, but any other code...

Replay Attack

Overview filament/filament is an A collection of full-stack components for accelerated Laravel app development. Affected versions of this package are vulnerable to Replay Attack in the handling of one-time codes for app-based multi-factor authentication. An attacker can gain unauthorized access b...

GHSA-XWPV-PQXP-5V36 Filament: Password validity disclosure for accounts denied panel access on login page

When multi-factor authentication is enabled, the login page presents the multi-factor challenge before evaluating canAccessPanel. For an account that canAccessPanel denies, submitting the correct password renders the challenge while an incorrect password returns the generic failure message,...

Filament: Password validity disclosure for accounts denied panel access on login page

When multi-factor authentication is enabled, the login page presents the multi-factor challenge before evaluating canAccessPanel. For an account that canAccessPanel denies, submitting the correct password renders the challenge while an incorrect password returns the generic failure message,...

Information Exposure

Overview filament/filament is an A collection of full-stack components for accelerated Laravel app development. Affected versions of this package are vulnerable to Information Exposure in the authentication process. An attacker can determine if a password is valid for an account by observing the...

EUVD-2026-65118

Filament: Multi-factor authentication app can be bypassed when recovery codes are enabled...

GHSA-52XP-W8HR-XV3C Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled

A flaw in the challenge handling for app-based multi-factor authentication allows the second factor to be bypassed. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled...

Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled

A flaw in the challenge handling for app-based multi-factor authentication allows the second factor to be bypassed. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled...

CVE-2026-84307

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login.php presents the multi-factor authentication challenge before evaluating canAccessPanel. For an account that canAccessPanel denies,...