CVE-2026-33080

Filament is a collection of full-stack components for accelerated Laravel development. Versions 4.0.0 through 4.8.4 and 5.0.0 through 5.3.4 have two Filament Table summarizers (Range, Values) that render raw database values without escaping HTML. If there is a lack of validation for the data in the columns that use these summarizers, an attacker could plant malicious HTML / JavaScript and achieve stored XSS that executes for users who view the table with those summarizers. This issue has been patched in versions 4.8.5 and 5.3.5.

• CWE-79
• CWE-80

• https://github.com/filamentphp/filament/commit/efa041aeeb4b1a99acd48aaa05584993c926d1edPatch
• https://github.com/filamentphp/filament/releases/tag/v4.8.5Product, Release Notes
• https://github.com/filamentphp/filament/releases/tag/v5.3.5Product, Release Notes
• https://github.com/filamentphp/filament/security/advisories/GHSA-vv3x-j2x5-36jcVendor Advisory

Published

Mar 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33075FastGPT is an AI Agent building platform. In versions 4.14.8…8.8
• CVE-2026-33076Roxy-WI is a web interface for managing Haproxy, Nginx, Apac…9.8
• CVE-2026-33077Roxy-WI is a web interface for managing Haproxy, Nginx, Apac…7.5
• CVE-2026-33078Roxy-WI is a web interface for managing Haproxy, Nginx, Apac…9.8
• CVE-2026-33079In versions 3.0.0a1 through 3.2.0 of Mistune, there is a ReD…8.7
• CVE-2026-3308An integer overflow vulnerability in 'pdf-image.c' in Artife…7.8
• CVE-2026-33081PinchTab is a standalone HTTP server that gives AI agents di…3.7
• CVE-2026-33082DataEase is an open source data visualization analysis tool.…9.8
• CVE-2026-33083DataEase is an open-source data visualization and analytics …8.8
• CVE-2026-33084DataEase is an open-source data visualization and analytics …8.8
• CVE-2026-33088Movable Type provided by Six Apart Ltd. contains an SQL Inje…9.8
• CVE-2026-3309The Paid Membership Plugin, Ecommerce, User Registration For…6.5