3
CVEs
0
Critical
1
High
0
KEV
3
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
1
MEDIUM
1
LOW
1
Monthly CVE Trend
Affected Products (2)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-77567 | App-based multi-factor authentication in Filament (the Laravel admin panel framework) can be fully bypassed by an attacker who possesses a user's primary credentials when recovery codes are enabled on the targeted account. Exploiting incorrect `required()` field logic in the MFA challenge form, an authenticated-first-factor attacker can toggle the recovery code path and submit the MFA form with both the TOTP code and recovery code fields left blank, passing validation and gaining full account access. Email-based MFA is unaffected; no public exploit or CISA KEV listing exists at time of analysis, though the logic flaw is straightforward and the fix is trivially reversible to derive an exploit. | HIGH | 8.1 | 0.3% | 61 |
PoC
|
| CVE-2026-84306 | TOTP app-based MFA in Filament 4.0.0-4.12.5 and 5.0.0-5.7.5 can be bypassed by replaying any previously-issued authenticator app code still within the configured clock-skew window, even after the legitimate account holder has authenticated with a newer code from the same window. The flaw is a cache-key design error: used-code state was keyed on md5(secret + code) rather than md5(secret) alone, making each distinct valid code within the window independently reusable once rather than collectively consuming the accepted timestep as RFC 6238 requires. An attacker holding the target's password and one intercepted TOTP code has approximately four minutes to authenticate and fully bypass MFA. No public exploit has been identified at time of analysis; email-based MFA is explicitly unaffected. | MEDIUM | 6.5 | 0.4% | 53 |
PoC
|
| CVE-2026-84307 | Password oracle in Filament's login flow (packages/panels/src/Auth/Pages/Login.php) allows unauthenticated remote attackers to confirm whether a guessed credential is valid for accounts that have MFA enabled but are denied panel access via canAccessPanel(). The observable discrepancy - a MFA challenge on a correct password versus a generic failure on an incorrect one - leaks credential validity without granting any session or panel access. Fixed in v4.12.5 and v5.7.5; no public exploit or KEV listing confirmed at time of analysis. | LOW | 3.7 | 0.3% | 39 |
PoC
|