https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 16:06:36 +0000 https://vulnerability.circl.lu/sighting/81d14363-5a03-400b-888b-372a1457cab5/export {"uuid": "81d14363-5a03-400b-888b-372a1457cab5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107845", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxibgbpjol2r", "content": "CVE-2026-107845 - comments-bundle\nAnyone can post a comment that contains malicious code, which will run automatically when a back\u2011end user opens the Comments module. This gives the attacker\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#commentsbundle #contao #composer #CVE #infosec", "creation_timestamp": "2026-10-10T00:50:05.664023Z"} {"uuid": "81d14363-5a03-400b-888b-372a1457cab5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107845", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxibgbpjol2r", "content": "CVE-2026-107845 - comments-bundle\nAnyone can post a comment that contains malicious code, which will run automatically when a back\u2011end user opens the Comments module. This gives the attacker\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#commentsbundle #contao #composer #CVE #infosec", "creation_timestamp": "2026-10-10T00:50:05.664023Z"} https://vulnerability.circl.lu/sighting/81d14363-5a03-400b-888b-372a1457cab5/export Sat, 10 Oct 2026 00:50:05 +0000 https://vulnerability.circl.lu/sighting/8d4fbbfa-faba-4715-8c96-65edc1de1d92/export {"uuid": "8d4fbbfa-faba-4715-8c96-65edc1de1d92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107845", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxhyd3i6rj2l", "content": "\ud83d\udea8 CVE-2026-107845 \u2014 CVSS 9.3 CRITICAL\n\nContao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can su...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-107845\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-09T22:07:14.808242Z"} {"uuid": "8d4fbbfa-faba-4715-8c96-65edc1de1d92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107845", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxhyd3i6rj2l", "content": "\ud83d\udea8 CVE-2026-107845 \u2014 CVSS 9.3 CRITICAL\n\nContao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can su...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-107845\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-09T22:07:14.808242Z"} https://vulnerability.circl.lu/sighting/8d4fbbfa-faba-4715-8c96-65edc1de1d92/export Fri, 09 Oct 2026 22:07:14 +0000 https://vulnerability.circl.lu/sighting/f25f39db-1786-4c76-8487-ff424de4fb78/export {"uuid": "f25f39db-1786-4c76-8487-ff424de4fb78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107845", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxhsyahaxk2r", "content": "\ud83d\udd34 CVE-2026-107845 - Critical (9.3)\n\nContao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visi...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-107845/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-09T20:31:43.289733Z"} {"uuid": "f25f39db-1786-4c76-8487-ff424de4fb78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107845", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxhsyahaxk2r", "content": "\ud83d\udd34 CVE-2026-107845 - Critical (9.3)\n\nContao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visi...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-107845/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-09T20:31:43.289733Z"} https://vulnerability.circl.lu/sighting/f25f39db-1786-4c76-8487-ff424de4fb78/export Fri, 09 Oct 2026 20:31:43 +0000 https://vulnerability.circl.lu/sighting/ae480b08-d4d3-49c0-a104-563698b8d794/export {"uuid": "ae480b08-d4d3-49c0-a104-563698b8d794", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107845", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117412661472610665", "content": "CVE-2026-107845 Contao: Cross-site scripting in the comments bundle Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments() in comments-bundle/contao/dca/tl_comments.php. When a backend user opens the Comments module, attacker-controlled script can execute in the Contao backend origin under that user's session. Unpublished comments remain visible to moderators, so moderation does not prevent exposure. This issue is fixed in versions 5.3.50 and 5.7.12.\nhttps://www.cve.org/CVERecord?id=CVE-2026-107845https://github.com/contao/contao/security/advisories/GHSA-628f-v4f6-p37rhttps://github.com/contao/contao/commit/22505d5f79bc1a7f52e2cba5fddf6007e1f0408ahttps://github.com/contao/contao/releases/tag/5.3.50https://github.com/contao/contao/releases/tag/5.7.12#contao#CVE_2026_107845#bot", "creation_timestamp": "2026-10-09T19:43:55.200142Z"} {"uuid": "ae480b08-d4d3-49c0-a104-563698b8d794", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107845", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117412661472610665", "content": "CVE-2026-107845 Contao: Cross-site scripting in the comments bundle Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments() in comments-bundle/contao/dca/tl_comments.php. When a backend user opens the Comments module, attacker-controlled script can execute in the Contao backend origin under that user's session. Unpublished comments remain visible to moderators, so moderation does not prevent exposure. This issue is fixed in versions 5.3.50 and 5.7.12.\nhttps://www.cve.org/CVERecord?id=CVE-2026-107845https://github.com/contao/contao/security/advisories/GHSA-628f-v4f6-p37rhttps://github.com/contao/contao/commit/22505d5f79bc1a7f52e2cba5fddf6007e1f0408ahttps://github.com/contao/contao/releases/tag/5.3.50https://github.com/contao/contao/releases/tag/5.7.12#contao#CVE_2026_107845#bot", "creation_timestamp": "2026-10-09T19:43:55.200142Z"} https://vulnerability.circl.lu/sighting/ae480b08-d4d3-49c0-a104-563698b8d794/export Fri, 09 Oct 2026 19:43:55 +0000