Product by Open Source
Contao
13 known vulnerabilities in Contao (Open Source), 0 of them actively exploited (CISA KEV).
Key figures
13
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2024-28235 | Contao possible cookie sharing with external domains while checking protected pages for broken links | 8.4 | |
| Critical | CVE-2026-107845 | Contao: Cross-site scripting in the comments bundle | 9.3 | |
| High | CVE-2026-126662 | Contao: Missing Authorization | 7.1 | |
| Medium | CVE-2026-126663 | Contao: Incorrect Behavior Order: Validate Before Canonicalize | 4.3 | |
| Medium | CVE-2026-107844 | Contao: Path traversal in the images controller | 5.3 | |
| Medium | CVE-2026-107843 | Contao: The registration module re-sends activation mails | 5.3 | |
| Medium | CVE-2026-107842 | Contao: Exposure of Sensitive Information to an Unauthorized Actor | 5.3 | |
| Medium | CVE-2026-107851 | Contao: Improper access control in the table access voter | 4.3 | |
| Medium | CVE-2026-107850 | Contao: Improper access control in the preview links module | 4.3 | |
| Low | CVE-2026-107848 | Contao: Cross-site request forgery in custom backend actions | 3.5 | |
| Low | CVE-2026-55825 | Contao: Possible path traversal in job download URIs | 3.1 | |
| Low | CVE-2026-57232 | Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module | 3.1 | |
| Low | CVE-2026-55824 | Contao crawler leaks auth credentials to external hosts | 2.6 |