Skip to contentTypo3 vulnerabilities
Newest
- typo3 cmsTYPO3 CMS - Broken Access Control in Backend and Install ToolCVE-2026-19418Fix available7.3 High
- typo3 cmsTYPO3 CMS - Unrestricted File Upload in Form FrameworkCVE-2026-15305Fix available6.3 Medium
- sensiolabs symfony, symfony html-sanitizer +1 moreSymfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing DefenseCVE-2026-48760Fix available5.3 Medium
- sensiolabs symfony, symfony html-sanitizer +1 moreSymfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> contentCVE-2026-48761Fix available5.3 Medium
- typo3 cmsTYPO3 CMS - Broken Access Control in Media ModuleCVE-2026-49742Fix available7.1 High
- typo3 cmsTYPO3 CMS - Privilege Escalation & SQL Injection in Form FrameworkCVE-2026-49741Fix available8.7 High
- typo3 cmsTYPO3 CMS - Insecure Deserialization in Core APICVE-2026-49740Fix available6.3 Medium
- typo3 cmsTYPO3 CMS - Broken Access Control in File Abstraction LayerCVE-2026-49738Fix available2.1 Low
- typo3 cmsTYPO3 CMS - Broken Access Control in Backend APICVE-2026-47352Fix available5.3 Medium
- typo3 cmsTYPO3 CMS - Broken Access Control in ClipboardCVE-2026-47351Fix available5.3 Medium
- typo3 cmsTYPO3 CMS - Broken Access Control in DataHandlerCVE-2026-47350Fix available5.3 Medium
- typo3 cmsTYPO3 CMS - Broken Access Control in RecyclerCVE-2026-47349Fix available5.3 Medium
- typo3 cmsTYPO3 CMS - Cross-Site Scripting in Indexed SearchCVE-2026-47348Fix available5.1 Medium
- typo3 cmsTYPO3 CMS - Open Redirect in Core UtilitiesCVE-2026-47347Fix available5.3 Medium
- typo3 cmsTYPO3 CMS - Broken Access Control in Form FrameworkCVE-2026-47346Fix available7.6 High
- typo3 cmsTYPO3 CMS - Destructive Actions on File Mount FoldersCVE-2026-47343Fix available7.2 High
- typo3 cmsTYPO3 CMS - Broken Access Control in Form FrameworkCVE-2026-11607Fix available7.6 High
- typo3 html sanitizerTYPO3 HTML Sanitizer allows Cross-Site ScriptingCVE-2026-47345Fix available5.1 Medium
- typo3 html sanitizerTYPO3 HTML Sanitizer allows Cross-Site ScriptingCVE-2026-47344Fix available2.1 Low
- sensiolabs symfony, symfony html-sanitizer +1 moreSymfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS)CVE-2026-45753Fix available2.1 Low
- sensiolabs symfony, symfony html-sanitizer +1 moreSymfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> MisclassificationCVE-2026-45066Fix available2.3 Low
- sensiolabs symfony, symfony html-sanitizer +1 moreSymfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href SpoofingCVE-2026-45064Fix available2.3 Low
- typo3 extension "content element selector"Remote Code Execution in extension "Content Element Selector" (ceselector)CVE-2026-46725Fix available9.2 Critical
- typo3 extension "address list"SQL Injection in extension "Address List" (tt_address)CVE-2026-8827Fix available8.2 High
- typo3 extension "faceted search"Path Traversal in extension "Faceted Search" (ke_search)CVE-2026-46724Fix available5.9 Medium
- typo3 extension "faceted search"Information Disclosure in extension "Faceted Search" (ke_search)CVE-2026-46723Fix available5.9 Medium
- typo3 extension "faceted search"XML External Entity Injection in extension "Faceted Search" (ke_search)CVE-2026-46722Fix available5.9 Medium
- typo3 extension "news system"SQL Injection in extension "News system" (news)CVE-2026-8726Public exploitFix available8.2 High
- typo3 extension "frontend user registration"Broken Access Control in extension "Frontend User Registration" (sf_register)CVE-2026-46721Fix available6.9 Medium
- typo3 extension "site crawler"Remote Code Execution in extension "Site Crawler" (crawler)CVE-2026-8727Fix available7.1 High
- typo3, typo3 cms +1 moreTYPO3 CMS Stores Cleartext Password in User Settings ModuleCVE-2026-6553Fix available7.3 High
- typo3 extension "e-mail mfa provider", mrsilaz mfa mail +1 moreAuthentication Bypass in extension "E-Mail MFA Provider" (mfa_email)CVE-2026-4208Fix available7.7 High
- ayacoo redirect tab, typo3 extension "redirect tabs" +1 moreBroken Access Control in extension "Redirect Tab"CVE-2026-4202Fix available2.3 Low
- cps-it mailqueue, typo3 extension "mailqueue" +1 moreInsecure Deserialization in extension "Mailqueue" (mailqueue)CVE-2026-1323Fix available5.2 Medium
- typo3 extension "mailqueue"Insecure Deserialization in extension "Mailqueue" (mailqueue)CVE-2026-0895Fix available5.2 Medium
- typo3, typo3 cms +1 moreTYPO3 CMS Allows Insecure Deserialization via Mailer File SpoolCVE-2026-0859Fix available5.2 Medium
- typo3, typo3 cms +1 moreTYPO3 CMS Allows Broken Access Control in Recycler ModuleCVE-2025-59022Fix available7.1 High
- typo3, typo3 cms +1 moreTYPO3 CMS Allows Broken Access Control in Redirects ModuleCVE-2025-59021Fix available5.3 Medium
- typo3, typo3 cms +1 moreTYPO3 CMS Allows Broken Access Control in Edit Document ControllerCVE-2025-59020Fix available5.3 Medium
- typo3 extension "modules"Broken Authentication in extension “Modules” (modules)CVE-2025-12998Fix available8.2 High
- typo3 extension "form to database" (form to database)Cross-Site Scripting in extension "Form to Database" (form_to_database)CVE-2025-10316Fix available2.3 Low
- typo3, typo3 cms +1 moreInformation Disclosure via CSV DownloadCVE-2025-59019Fix available5.3 Medium
- typo3, typo3 cms +1 moreInformation Disclosure in Workspaces ModuleCVE-2025-59018Fix available7.1 High
- typo3, typo3 cms +1 moreBroken Access Control in Backend AJAX RoutesCVE-2025-59017Fix available5.3 Medium
- typo3, typo3 cms +1 moreInformation Disclosure via File Abstraction LayerCVE-2025-59016Fix available5.3 Medium
- typo3, typo3 cms +1 moreInsufficient Entropy in Password GenerationCVE-2025-59015Fix available6.3 Medium
- typo3, typo3 cms +1 moreDenial of Service in TYPO3 Bookmark ToolbarCVE-2025-59014Fix available5.1 Medium
- typo3, typo3 cms +1 moreOpen Redirect in TYPO3 CMSCVE-2025-59013Fix available5.3 Medium
- typo3 extension "typo3 backup plus", extension “backup plus” +1 moreCommand Injection in extension "TYPO3 Backup Plus" (ns_backup)CVE-2025-95738.6 High
- typo3 extension "femanager", typo3 +1 moreInsecure Direct Object Reference in extension "femanager" (femanager)CVE-2025-7900Fix available5.3 Medium
- Show moreLoading…