PatchClock

PHP security digest · Packages

contao/comments-bundle security advisories

1 advisory we have followed since September 2026, 1 of them critical or high, newest first. Each page says who is affected, which versions fix it and how to check your project.

  1. Critical 9 Oct 2026

    Contao: Cross-site scripting in the comments bundle

    Fixed in 5.3.50, 5.7.12 · CVE-2026-107845

Check your project in one command

Composer compares your composer.lock with the public advisory databases:

composer audit

It lists every installed package with a known advisory, including contao/comments-bundle, and the version that fixes it.