Known Vulnerabilities for TYPO3 CMS by TYPO3
Listed below are 10 of the newest known vulnerabilities associated with "TYPO3 CMS" by "TYPO3".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-113459 json | In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor p... | Not Provided | 2026-10-20 | 2026-10-20 |
| CVE-2026-112069 json | The extension no longer applied its access protection to files in file storages that use a non-default relative base path. Th... | Not Provided | 2026-10-20 | 2026-10-20 |
| CVE-2026-109162 json | Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default ... | Not Provided | 2026-10-13 | 2026-10-16 |
| CVE-2026-85400 json | Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuratio... | Not Provided | 2026-09-08 | 2026-09-08 |
| CVE-2026-77138 json | The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize()... | Not Provided | 2026-08-25 | 2026-08-25 |
| CVE-2026-77132 json | It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization chec... | Not Provided | 2026-09-08 | 2026-09-08 |
| CVE-2026-77131 json | When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encryptin... | Not Provided | 2026-08-25 | 2026-08-25 |
| CVE-2026-77127 json | The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or ... | Not Provided | 2026-08-25 | 2026-08-25 |
| CVE-2026-56095 json | The extension's indexer passed every field value returned by content object rendering through PHP's unserialize() function wh... | Not Provided | 2026-08-25 | 2026-09-17 |
| CVE-2026-56094 json | The extension allows a request-provided additionalFilters parameter to register a named siteHash filter before the system's o... | Not Provided | 2026-08-25 | 2026-09-17 |