contao vulnerabilities
35 published CVEs name contao among the affected products.
- 35Published CVEs35 of them scored
- 15Last 12 monthspublished in the last year
- 1Critical7 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-128335
Contao before 5.3.54, 5.7.17, and 6.0.6 Session Invalidation Failure on 2FA Change
Contao · Contao
Low2.1 - CVE-2026-126663
Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 Path Traversal via Image Insert Tag
Contao · Contao
Medium5.3 - CVE-2026-126662
Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 Filemount Bypass via Edit-Multiple
Contao · Contao
High7.1 - CVE-2026-107851
Contao: Improper access control in the table access voter
contao · contao
Medium4.3 - CVE-2026-107850
Contao: Improper access control in the preview links module
contao · contao
Medium4.3 - CVE-2026-107848
Contao: Cross-site request forgery in custom backend actions
contao · contao
Low3.5 - CVE-2026-107845
Contao: Cross-site scripting in the comments bundle
contao · contao
Critical9.3 - CVE-2026-107844
Contao: Path traversal in the images controller
contao · contao
Medium5.3 - CVE-2026-107843
Contao: The registration module re-sends activation mails on any unauthenticated POST, with no throttle and no captcha check
contao · contao
Medium5.3 - CVE-2026-107842
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
contao · contao
Medium5.3