https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T01:15:06.608980+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-186145 EUVD-2026-186145 2026-10-07T01:15:06.612214+00:00 EUVD-2026-186145 https://cve.radiocsirt.org/vuln/fkie_cve-2024-45612 fkie_cve-2024-45612 2026-10-07T01:15:06.612256+00:00

Contao is an Open Source CMS. In affected versions an untrusted user can inject insert tags into the canonical tag, which are then replaced on the web page (front end). Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to upgrade should disable canonical tags in the root page settings.

 https://cve.radiocsirt.org/vuln/ghsa-2xpq-xp6c-5mgj GHSA-2xpq-xp6c-5mgj — Contao affected by insert tag injection via canonical URL 2026-10-07T01:15:06.612300+00:00

Affected: Packagist: contao/core-bundle

### Impact

It is possible to inject insert tags in canonical URLs which will be replaced when the page is rendered.

### Patches

Update to Contao 4.13.49, 5.3.15 or 5.4.3.

### Workarounds

Disable canonical tags in the settings of the website root page.

### References

https://contao.org/en/security-advisories/insert-tag-injection-via-canonical-urls

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).

 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-2152 WID-SEC-W-2024-2152 — Contao: Mehrere Schwachstellen 2026-10-07T01:15:06.612351+00:00

Ein entfernter Angreifer kann mehrere Schwachstellen in Contao ausnutzen, um beliebigen Code auszuführen oder vertrauliche Informationen offenzulegen.