Typo3 vulnerabilities
198 CVEs and advisories name Typo3 as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-120327Open Redirection in extension "Mail" (mail)
- CVE-2026-120328Information Disclosure in extension "Mail" (mail)
- CVE-2026-120329Broken Access Control in extension "Mail" (mail)
- CVE-2026-120330Broken Access Control in extension "Mail" (mail)
- CVE-2026-120331Server-Side Request Forgery in extension "Mail" (mail)
- CVE-2026-120332Cross-Site Scripting in extension "Mail" (mail)
- CVE-2026-120333Broken Access Control in extension "Frontend User Registration" (sf_register)
- CVE-2026-112069Broken Access Control in extension "FAL Protect" (fal_protect)
- CVE-2026-112065Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)
- CVE-2026-112064SQL Injection in extension "sgalinski Cookie Consent" (sg_cookie_optin)
- CVE-2026-112066Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)
- CVE-2026-112067Captcha Bypass in extension "Accessible Form Captcha" (bw_captcha)
- CVE-2026-112068Insecure Direct Object Reference in extension "Analytics" (analytics)
- CVE-2026-112237Server-Side Request Forgery in extension "Kitodo.Presentation" (dlf)
- CVE-2026-112240Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)
- CVE-2026-113442Cross-Site Scripting in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)
- CVE-2026-112238SQL Injection in extension "File manager" (ameos_filemanager)
- CVE-2026-112071Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)
- CVE-2026-113468Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)
- CVE-2026-112239Broken Access Control in extension "TYPO3 AI Integration Extension" (ns_t3ai)
- CVE-2026-113459Sensitive Data Exposure in extension "TYPO3 AI Integration Extension" (ns_t3ai)
- CVE-2026-112070Broken Access Control in extension "Analytics" (analytics)
- CVE-2026-109162TYPO3 CMS - Security Misconfiguration in Form Framework
- CVE-2023-50462An issue was discovered in the content_consent (aka Content Consent) extension through 2.0.1 for TYPO3.
- CVE-2023-50461An issue was discovered in the direct_mail (aka Direct Mail) extension through 9.5.1 for TYPO3.
- CVE-2023-50460An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3.
- CVE-2023-50459An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3.
- CVE-2023-45023The femanager extension 7 before 7.2.2 for TYPO3 has Incorrect Access Control: it lacks a check for permissions for the invitation component
- CVE-2026-77132TYPO3 CMS - Information Disclosure via Backend Localization Wizard
- CVE-2026-85400TYPO3 CMS - Missing Authorization in lowlevel commands