https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T21:37:12.581061+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-251315 EUVD-2026-251315 2026-10-03T21:37:12.648450+00:00 EUVD-2026-251315 https://cve.radiocsirt.org/vuln/fkie_cve-2025-57756 fkie_cve-2025-57756 2026-10-03T21:37:12.648493+00:00

Contao is an Open Source CMS. In versions starting from 4.9.14 and prior to 4.13.56, 5.3.38, and 5.6.1, protected content elements that are rendered as fragments are indexed and become publicly available in the front end search. This issue has been patched in versions 4.13.56, 5.3.38, and 5.6.1. A workaround involves disabling the front end search.

 https://cve.radiocsirt.org/vuln/ghsa-2xmj-8wmq-7475 GHSA-2xmj-8wmq-7475 — Contao discloses sensitive information in the front end search index 2026-10-03T21:37:12.648528+00:00

Affected: Packagist: contao/core-bundle, Packagist: contao/contao

### Impact

Protected content elements that are rendered as fragments are indexed and become publicly available in the front end search.

### Patches

Update to Contao 4.13.56, 5.3.38 or 5.6.1.

### Workarounds

Disable the front end search.

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1920 WID-SEC-W-2025-1920 — Contao: Mehrere Schwachstellen 2026-10-03T21:37:12.648564+00:00

Ein Angreifer kann mehrere Schwachstellen in Contao ausnutzen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.