Typo3 vulnerabilities
198 CVEs and advisories name Typo3 as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-56092Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
- CVE-2026-56093Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
- CVE-2026-56094Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
- CVE-2026-56095Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
- CVE-2026-56096Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
- CVE-2026-77127Information Disclosure in extension "Modules" (modules)
- CVE-2026-77128Broken Access Control in extension "Event management and registration" (sf_event_mgt)
- CVE-2026-77129Server-Side Template Injection in extension "Event management and registration" (sf_event_mgt)
- CVE-2026-77130Insufficient Session Expiration in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)
- CVE-2026-77131Cleartext Transmission of Sensitive Information in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)
- CVE-2026-77133Broken Access Control in extension "femanager" (femanager)
- CVE-2026-77134Broken Access Control in extension "femanager" (femanager)
- CVE-2026-77135Information Disclosure in extension "femanager" (femanager)
- CVE-2026-77136Server-Side Template Injection in extension "powermail" (powermail)
- CVE-2026-77137SQL Injection in extension "Forms Export" (frp_form_answers)
- CVE-2026-77138Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail)
- CVE-2026-77139Path Traversal in extension "Mask" (mask)
- CVE-2026-77140Broken Access Control in extension "Telephone Directory" (telephonedirectory)
- CVE-2026-77141Broken Access Control in extension "Club Directory" (clubdirectory)
- CVE-2026-77142Broken Access Control in extension "Industry Directory" (yellowpages2)
- CVE-2026-77143Broken Access Control in extension "Forum" (pforum)
- CVE-2026-77144Broken Access Control in extension "Events 2" (events2)
- CVE-2026-77145Broken Access Control in extension "Events 2" (events2)
- CVE-2026-77146Broken Access Control in extension "femanager" (femanager)
- CVE-2026-19418TYPO3 CMS - Broken Access Control in Backend and Install Tool
- CVE-2026-15305TYPO3 CMS - Unrestricted File Upload in Form Framework
- CVE-2026-49742TYPO3 CMS - Broken Access Control in Media Module
- CVE-2026-49741TYPO3 CMS - Privilege Escalation & SQL Injection in Form Framework
- CVE-2026-49740TYPO3 CMS - Insecure Deserialization in Core API
- CVE-2026-49738TYPO3 CMS - Broken Access Control in File Abstraction Layer