Insufficient CSRF protection for backend login (see GHSA-rgq4-cg48-xjxj)

More info at https://github.com/contao/contao/security/advisories/GHSA-rgq4-cg48-xjxj...

Contao crawler leaks confidental headers (see GHSA-26h3-f97j-vj85)

More info at https://github.com/contao/contao/security/advisories/GHSA-26h3-f97j-vj85...

Path traversal via decode-after-check in the image insert tag (see GHSA-r7cf-mfp4-r23h)

More info at https://github.com/contao/contao/security/advisories/GHSA-r7cf-mfp4-r23h...

HTML sanitizer is vulnerable to DOM clobbering (see GHSA-58r4-2p86-jp4x)

More info at https://github.com/contao/contao/security/advisories/GHSA-58r4-2p86-jp4x...

HTML sanitizer is vulnerable to DOM clobbering (see GHSA-58r4-2p86-jp4x)

More info at https://github.com/contao/contao/security/advisories/GHSA-58r4-2p86-jp4x...

Stored cross-site scripting in the file manager via crafted filenames (see GHSA-xh3r-77ch-frm3)

More info at https://github.com/contao/contao/security/advisories/GHSA-xh3r-77ch-frm3...

Insufficient CSRF protection for backend login (see GHSA-rgq4-cg48-xjxj)

More info at https://github.com/contao/contao/security/advisories/GHSA-rgq4-cg48-xjxj...

Cross-site scripting in the figure insert tag (see GHSA-pc2r-hvrc-f4v6)

More info at https://github.com/contao/contao/security/advisories/GHSA-pc2r-hvrc-f4v6...

phpseclib unbounded PBKDF iteration count in encrypted key/PFX/CMS parsing enables CPU-exhaustion DoS

More info at https://github.com/phpseclib/phpseclib/security/advisories/GHSA-w3p9-g4p2-h3rr...

gRPC PHP: bundled CA store trusts compromised eMudhra intermediate CAs

More info at https://github.com/grpc/grpc/security/advisories/GHSA-gvrc-7wf9-p7hg...

HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar: Incomplete Fix for CVE-2026-48761

More info at https://github.com/symfony/symfony/security/advisories/GHSA-wm2w-4mgj-vw33...