contao vulnerabilities

CVEs per yearBy the year they were published

1. 20201
2. 20212
3. 20221
4. 20232
5. 20249
6. 20257
7. 202610

Newest CVEs

• CVE-2026-107851

  Contao: Improper access control in the table access voter

  contao · contao

  Medium4.3
• CVE-2026-107850

  Contao: Improper access control in the preview links module

  contao · contao

  Medium4.3
• CVE-2026-107848

  Contao: Cross-site request forgery in custom backend actions

  contao · contao

  Low3.5
• CVE-2026-107845

  Contao: Cross-site scripting in the comments bundle

  contao · contao

  Critical9.3
• CVE-2026-107844

  Contao: Path traversal in the images controller

  contao · contao

  Medium5.3
• CVE-2026-107843

  Contao: The registration module re-sends activation mails on any unauthenticated POST, with no throttle and no captcha check

  contao · contao

  Medium5.3
• CVE-2026-107842

  Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled

  contao · contao

  Medium5.3
• CVE-2026-55825

  Contao: Possible path traversal in job download URIs

  contao · contao

  Low3.1
• CVE-2026-55824

  Contao crawler leaks auth credentials to external hosts

  contao · contao

  Low2.6
• CVE-2026-57232

  Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module

  contao · contao

  Low3.1