contao/comments-bundle vulnerabilities

CVEs whose affected-version data names the contao/comments-bundle package (composer). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-107845Critical· 9.3

yesterday

Contao is an Open Source CMS

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments() in comm…

▾ Midnightcontao · contao/comments-bundlevia NVD