CO
Product
contao
42
CVEs
0
On KEV
9.8
Max CVSS
7
New 30D
Severity mix
Critical 3High 6Medium 29Low 4
Watch
Add contao to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-107848 | 3.5 | Oct 9 | Contao: Cross-site request forgery in custom backend actions Affected: >= 4.0.0, < 5.3.50; >= 5.4.0-RC1, < 5.7.12 |
| CVE-2026-55825 | 3.1 | Jul 31 | Contao: Possible path traversal in job download URIs Affected: >= 5.7.0, < 5.7.7 |
| CVE-2026-57232 | 3.1 | Jul 31 | Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module Affected: >= 5.7.0-RC1, < 5.7.9; >= 5.3.35, < 5.3.48 |
| CVE-2026-55824 | 2.6 | Jul 31 | Contao crawler leaks auth credentials to external hosts Affected: >= 4.13.40, < 5.3.47; >= 5.7.0-RC1, < 5.7.7 |
Showing 4