CVSS Score: 5.3 Published: 2026-10-09 Full Report: https://cvereports.com/reports/CVE-2026-107844
A path traversal vulnerability (CWE-22) in Contao CMS allows unauthenticated remote attackers to bypass directory boundary restrictions in ImagesController and access files within the project directory.
CVSS Score: 3.5 Published: 2026-10-09 Full Report: https://cvereports.com/reports/CVE-2026-107848
Contao Open Source CMS versions 4.0.0 through 5.3.49 and 5.4.0-RC1 through 5.7.11 contain a Cross-Site Request Forgery (CSRF) vulnerability in backend parameter handling. The RequestTokenListener component validates anti-CSRF tokens solely for HTTP POST requests, while GET-based declarative guards run only when an act parameter is present in the query string. Consequently, custom backend actions dispatched via alternative parameters such as key= can execute without CSRF token verification when triggered by an authenticated user.
CVSS Score: 5.3 Published: 2026-10-09 Full Report: https://cvereports.com/reports/CVE-2026-107843
Contao CMS versions 4.1.0 through 5.3.49 and 5.4.0-RC1 through 5.7.11 fail to validate form submission tokens and enforce rate limiting when processing activation email resend requests via HTTP POST, enabling resource exhaustion and account state enumeration.
CVSS Score: 5.3 Published: 2026-10-09 Full Report: https://cvereports.com/reports/CVE-2026-107842
An information disclosure vulnerability in Contao CMS allows unauthenticated site visitors to view protected page titles, URLs, and text excerpts through search queries when protected page indexing is disabled after previously being enabled.
CVSS Score: 6.5 Published: 2026-10-09 Full Report: https://cvereports.com/reports/GHSA-G38J-7V97-X298
In Vikunja prior to version 2.6.0, relation creation via the CalDAV endpoint fails to invoke the TaskRelation.CanCreate authorization check. This missing access control allows an authenticated user to establish unauthorized relationships and perform write operations against any task, provided its unique identifier (UID) is known.
CVSS Score: 6.8 Published: 2026-10-09 Full Report: https://cvereports.com/reports/GHSA-3HC7-R24J-RPWC
A cross-project information disclosure vulnerability in Vikunja allows authenticated users with read access to one project to view private task details from unauthorized projects via subtask expansion parameters.
CVSS Score: 4.3 Published: 2026-10-09 Full Report: https://cvereports.com/reports/GHSA-8WVG-R2J4-3737
An information disclosure vulnerability in Vikunja allows authenticated users with read access to a task to expose private email addresses of assigned users through the API task assignees endpoint due to an unmasked database query.
CVSS Score: 5.3 Published: 2026-10-09 Full Report: https://cvereports.com/reports/GHSA-W2CH-4XGR-22WW
An authorization bypass vulnerability in Vikunja versions prior to v2.6.0 permits authenticated users to delete relationships between tasks across project boundaries without requiring read or write authorization for the target related task.
CVSS Score: 6.9 Published: 2026-10-09 Full Report: https://cvereports.com/reports/CVE-2026-108258
A path traversal vulnerability in Shiny for Python (posit-dev/py-shiny) versions 1.4.0 through 1.6.3 allows unauthenticated remote attackers to read arbitrary files and traverse directories via crafted state_id query parameters.
CVSS Score: 7.6 Published: 2026-10-09 Full Report: https://cvereports.com/reports/CVE-2026-108260
A Stored Cross-Site Scripting vulnerability in @tinacms/web-components prior to version 0.2.1 allows low-privileged content authors to execute arbitrary JavaScript code in the context of website visitors via unsanitized URL attributes in custom Markdown rendering components.
