{ "schemaVersion": 1, "site": "https://cveboard.org", "generatedAt": "2026-10-23T19:17:11.271Z", "lastRun": "2026-10-23T19:01:02.861Z", "liveDays": 14, "filters": { "kind": null, "exploited": false, "severity": null, "ecosystems": [], "tag": "composer" }, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "incidents": [ { "id": "cve-2026-107845", "url": "https://cveboard.org/i/cve-2026-107845", "urlPt": "https://cveboard.org/pt/i/cve-2026-107845", "json": "https://cveboard.org/i/cve-2026-107845.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Contao: Cross-site scripting in the comments bundle", "summary": "An unauthenticated front end visitor can post a comment containing a XSS injection. The victim is any back end user who opens the Comments module, and moderation makes exposure certain rather than preventing it. No Content-Security-Policy header is sent on the Contao back end, so nothing mitigates the inline handler.", "titlePt": "Contao: cross-site scripting no pacote de comentários", "summaryPt": "Um visitante do front end não autenticado pode postar um comentário contendo uma injeção XSS. A vítima é qualquer usuário do back end que abrir o módulo de Comentários, e a moderação torna a exposição certa em vez de preveni-la. Nenhum cabeçalho Content-Security-Policy é enviado no back end do Contao, então nada mitiga o manipulador inline.", "affected": [ { "vendor": "contao", "product": "contao", "defaultStatus": "unknown", "versions": [ { "version": ">= 4.0.0, < 5.3.50", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": ">= 5.4.0-RC1, < 5.7.12", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, { "id": "CWE-116", "name": "Improper Encoding or Escaping of Output" } ], "ssvc": { "exploitation": "none", "automatable": "no", "impact": "total", "at": "2026-10-09T19:51:37.559Z" }, "fix": "listed", "tags": [ "contao", "composer" ], "cves": [ "CVE-2026-107845" ], "ghsa": "GHSA-628f-v4f6-p37r", "cvss": { "score": 9.3, "version": "3.1", "by": "GitHub" }, "epss": { "percentage": 0.00272, "percentile": 0.18523, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "composer", "name": "contao/comments-bundle", "vulnerable": ">= 4.0.0, < 5.3.50", "fixed": "5.3.50", "advisory": "GHSA-628f-v4f6-p37r" }, { "ecosystem": "composer", "name": "contao/comments-bundle", "vulnerable": ">= 5.4.0-RC1, < 5.7.12", "fixed": "5.7.12", "advisory": "GHSA-628f-v4f6-p37r" } ], "vendor": "contao", "product": "contao", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-628f-v4f6-p37r" } ], "publishedAt": "2026-10-09T20:53:50.000Z", "updatedAt": "2026-10-09T20:53:50.000Z" }, { "id": "cve-2026-92161", "url": "https://cveboard.org/i/cve-2026-92161", "urlPt": "https://cveboard.org/pt/i/cve-2026-92161", "json": "https://cveboard.org/i/cve-2026-92161.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider", "summary": "An unauthenticated account takeover vulnerability exists in fof/oauth when the Discord OAuth provider is enabled.", "titlePt": "FriendsOfFlarum OAuth: tomada de conta de conta não autenticada via confiança em e-mail não verificado no provedor de OAuth do Discord", "summaryPt": "Uma vulnerabilidade de tomada de conta de conta não autenticada existe no fof/oauth quando o provedor de OAuth do Discord está habilitado.", "affected": [ { "vendor": "FriendsOfFlarum", "product": "oauth", "defaultStatus": "unknown", "versions": [ { "version": "< 1.7.4", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": ">= 2.0.0-beta.1, < 2.0.0-beta.4", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-345", "name": "Insufficient Verification of Data Authenticity" } ], "ssvc": { "exploitation": "none", "automatable": "yes", "impact": "total", "at": "2026-09-29T19:20:48.556Z" }, "fix": "listed", "tags": [ "friendsofflarum", "composer" ], "cves": [ "CVE-2026-92161" ], "ghsa": "GHSA-g7vj-c29h-3h5m", "cvss": { "score": 9.8, "version": "3.1", "by": "GitHub" }, "epss": { "percentage": 0.00272, "percentile": 0.18559, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "composer", "name": "fof/oauth", "vulnerable": "< 1.7.4", "fixed": "1.7.4", "advisory": "GHSA-g7vj-c29h-3h5m" }, { "ecosystem": "composer", "name": "fof/oauth", "vulnerable": ">= 2.0.0-beta.1, < 2.0.0-beta.4", "fixed": "2.0.0-beta.4", "advisory": "GHSA-g7vj-c29h-3h5m" } ], "vendor": "FriendsOfFlarum", "product": "oauth", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-g7vj-c29h-3h5m" } ], "publishedAt": "2026-09-25T15:55:07.000Z", "updatedAt": "2026-09-25T15:55:07.000Z" } ], "tag": { "tag": "composer", "name": "Packagist", "kev": null } }