CVE-2026-33080

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Filament is a collection of full-stack components for accelerated Laravel development. Versions 4.0.0 through 4.8.4 and 5.0.0 through 5.3.4 have two Filament Table summarizers (Range, Values) that render raw database values without escaping HTML. If there is a lack of validation for the data in the columns that use these summarizers, an attacker could plant malicious HTML / JavaScript and achieve stored XSS that executes for users who view the table with those summarizers. This issue has been patched in versions 4.8.5 and 5.3.5.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-80

Affected software

No affected versions have been published.

Timeline

Published: Mar 20, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-330813.7PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. Versions 0.8.2 and below have a Blind SSRF v CVE-2026-330829.8DataEase is an open source data visualization analysis tool. Versions 2.10.20 and below contain a SQL injection vulnerability in the dataset CVE-2026-330838.8DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in th CVE-2026-330848.8DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in th CVE-2026-330889.8Movable Type provided by Six Apart Ltd. contains an SQL Injection vulnerability which may allow an attacker to execute an arbitrary SQL stat CVE-2026-33096.5The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPre CVE-2026-330927.8Local privilege escalation due to improper handling of environment variables. The following products are affected: Acronis True Image OEM (m CVE-2026-330935.3Anviz CX7 Firmware is vulnerable to an unauthenticated POST to the device that captures a photo with the front facing camera, exposing visu CVE-2026-330957.8Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2026-330967.5Out-of-bounds read in Windows HTTP.sys allows an unauthorized attacker to deny service over a network.CVE-2026-330987.8Use after free in Windows Container Isolation FS Filter Driver allows an authorized attacker to elevate privileges locally.CVE-2026-330997.0Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.