P
Vendor security profile
packagist
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs299
Critical26
CISA KEV0
Public exploit73
Patch rate%54
Avg. CVSS6.8
12-month vulnerability rate
0
0
0
2
7
1
1
18
70
103
83
12
CVE KEV
CVE severity distribution
299toplam CVE
Critical26 (9%)
High120 (40%)
Medium122 (41%)
Low22 (7%)
Uncertain9 (3%)
Patch and exploitation view
%54
Verified patch
%0
CISA KEV
%24
Public exploit
162Patch available
0Partial
2Workaround
0Vendor: no patch
135Unknown
Latest vulnerabilities
4.3
CVE-2026-107851
Contao: Improper access control in the table access voter
C
Patch status unknownEPSS %0
4.3
CVE-2026-107850
Contao: Improper access control in the preview links module
C
Patch status unknownEPSS %0
3.5
CVE-2026-107848
Contao: Cross-site request forgery in custom backend actions
C
Patch status unknownEPSS %0
9.3
CVE-2026-107845
Contao: Cross-site scripting in the comments bundle
C
Patch status unknownEPSS %0
5.3
CVE-2026-107844
Contao: Path traversal in the images controller
C
Patch status unknownEPSS %0
5.3
CVE-2026-107843
Contao: The registration module re-sends activation mails on any unauthenticated POST, with no throttle and no captcha check
C
Patch status unknownEPSS %0
5.3
CVE-2026-107842
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
C
Patch status unknownEPSS %0
6.5
CVE-2026-107381
svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences
P
Patch status unknown
5.4
CVE-2026-107380
enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision
D
Patch status unknownEPSS %0
6.5
CVE-2026-107379
enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash
D
Patch status unknownEPSS %0