Typo3 vulnerabilities
198 CVEs and advisories name Typo3 as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-47352TYPO3 CMS - Broken Access Control in Backend API
- CVE-2026-47351TYPO3 CMS - Broken Access Control in Clipboard
- CVE-2026-47350TYPO3 CMS - Broken Access Control in DataHandler
- CVE-2026-47349TYPO3 CMS - Broken Access Control in Recycler
- CVE-2026-47348TYPO3 CMS - Cross-Site Scripting in Indexed Search
- CVE-2026-47347TYPO3 CMS - Open Redirect in Core Utilities
- CVE-2026-47346TYPO3 CMS - Broken Access Control in Form Framework
- CVE-2026-47343TYPO3 CMS - Destructive Actions on File Mount Folders
- CVE-2026-11607TYPO3 CMS - Broken Access Control in Form Framework
- CVE-2026-47345TYPO3 HTML Sanitizer allows Cross-Site Scripting
- CVE-2026-47344TYPO3 HTML Sanitizer allows Cross-Site Scripting
- CVE-2026-46725Remote Code Execution in extension "Content Element Selector" (ceselector)
- CVE-2026-8827SQL Injection in extension "Address List" (tt_address)
- CVE-2026-46724Path Traversal in extension "Faceted Search" (ke_search)
- CVE-2026-46723Information Disclosure in extension "Faceted Search" (ke_search)
- CVE-2026-46722XML External Entity Injection in extension "Faceted Search" (ke_search)
- CVE-2026-8726SQL Injection in extension "News system" (news)
- CVE-2026-46721Broken Access Control in extension "Frontend User Registration" (sf_register)
- CVE-2026-8727Remote Code Execution in extension "Site Crawler" (crawler)
- CVE-2026-6553TYPO3 CMS Stores Cleartext Password in User Settings Module
- CVE-2026-4208Authentication Bypass in extension "E-Mail MFA Provider" (mfa_email)
- CVE-2026-4202Broken Access Control in extension "Redirect Tab"
- CVE-2026-1323Insecure Deserialization in extension "Mailqueue" (mailqueue)
- CVE-2026-0895Insecure Deserialization in extension "Mailqueue" (mailqueue)
- CVE-2026-0859TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool
- CVE-2025-59022TYPO3 CMS Allows Broken Access Control in Recycler Module
- CVE-2025-59021TYPO3 CMS Allows Broken Access Control in Redirects Module
- CVE-2025-59020TYPO3 CMS Allows Broken Access Control in Edit Document Controller
- CVE-2025-12998Broken Authentication in extension “Modules” (modules)
- CVE-2025-10316Cross-Site Scripting in extension "Form to Database" (form_to_database)