Cross-site scripting in the frontend search results (see GHSA-h57j-5f5m-789v)

PKSA-snk8-7c3n-1x4z

Affected version: >=4.9.0,<5.3.50|>=5.4.0,<5.7.12

Reported by:
FriendsOfPHP/security-advisories

Unrestricted activation email resending (see GHSA-mfxh-vp55-7gc6)

PKSA-wrr4-414y-fqmj

Affected version: >=4.1.0,<5.3.50|>=5.4.0,<5.7.12

Reported by:
FriendsOfPHP/security-advisories

Cross-site request forgery in custom backend actions (see GHSA-9ff2-p842-45wq)

PKSA-4788-1fwx-c4gc

Affected version: >=4.0.0,<5.3.50|>=5.4.0,<5.7.12

Reported by:
FriendsOfPHP/security-advisories

Exposure of sensitive information through a stale search index (see GHSA-x2rp-9qf7-2fmq)

PKSA-cvfh-n5dv-w5t9

Affected version: >=4.0.0,<5.3.50|>=5.4.0,<5.7.12

Reported by:
FriendsOfPHP/security-advisories

[LOW] Credentials disclosure in the crawler

PKSA-f8tt-pn3h-s2tw CVE-2026-55824 GHSA-3mr9-p497-58f6

Affected version: >=4.13.0,<5.3.47|>=5.4.0,<5.7.7

Reported by:
FriendsOfPHP/security-advisories, GitHub

[LOW] Contao is vulnerable to cross-site scripting in templates

PKSA-3p5h-vgz7-458z CVE-2025-65961 GHSA-68q5-78xp-cwwc

Affected version: >=5.4.0-RC1,<5.6.5|>=5.0.0-RC1,<5.3.42|>=4.0.0,<4.13.57

Reported by:
GitHub

[MEDIUM] Contao is vulnerable to remote code execution in template closures

PKSA-wjhx-cdbz-9x61 CVE-2025-65960 GHSA-98vj-mm79-v77r

Affected version: >=5.4.0-RC1,<5.6.5|>=5.0.0-RC1,<5.3.42|>=4.0.0,<4.13.57

Reported by:
GitHub