Composer typo3/cms-core has 158 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2018-14041 | Bootstrap Cross-site Scripting vulnerability | medium | 6.1 | >=8.0.0 and <8.7.23 or >=9.0.0 and <9.5.4 | 8.7.23, 9.5.4 |
| CVE-2019-11832 | TYPO3 Image Processing susceptible to Code Execution | high | 7.5 | >=8.0.0 and <8.7.25 or >=9.0.0 and <9.5.6 | 8.7.25, 9.5.6 |
| CVE-2013-1842 | TYPO3 SQL injection vulnerability in the Extbase Framework | high | 7.4 | >=4.5.0 and <4.5.24 or >=4.6.0 and <4.6.17 or >=4.7.0 and <4.7.9 or >=6.0.0 and <6.0.3 | 4.5.24, 4.6.17, 4.7.9, 6.0.3 |
| CVE-2008-2717 | TYPO3 Unrestricted File Upload vulnerability | medium | 0.0 | >=4.0.0 and <4.0.9 or >=4.1.0 and <4.1.7 or >=4.2.0 and <4.2.1 | 4.0.9, 4.1.7, 4.2.1 |
| CVE-2013-1843 | TYPO3 Open redirect vulnerability in the Access tracking mechanism | medium | 5.3 | >=4.5.0 and <4.5.24 or >=4.6.0 and <4.6.17 or >=4.7.0 and <4.7.9 or >=6.0.0 and <6.0.3 | 4.5.24, 4.6.17, 4.7.9, 6.0.3 |
| CVE-2019-10912 | Deserialization of untrusted data in Symfony | high | 7.1 | >=9.0.0 and <9.5.8 | 9.5.8 |
| CVE-2020-15098 | Missing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMS | high | 8.8 | >=9.0.0 and <9.5.20 or >=10.0.0 and <10.4.6 | 9.5.20, 10.4.6 |
| CVE-2024-22188 | TYPO3 Install Tool vulnerable to Code Execution | high | 7.2 | >=8.0.0 and <8.7.57 or >=9.0.0 and <9.5.46 or >=10.0.0 and <10.4.43 or >=11.0.0 and <11.5.35 or >=12.0.0 and <12.4.11 or >=13.0.0 and <13.0.1 | 8.7.57, 9.5.46, 10.4.43, 11.5.35 |
| CVE-2020-11067 | Insecure Deserialization in Backend User Settings in TYPO3 CMS | high | 8.8 | >=9.0.0 and <9.5.17 or >=10.0.0 and <10.4.2 | 9.5.17, 10.4.2 |
| CVE-2018-17960 | Ckeditor XSS Vulnerability | medium | 6.1 | >=8.0.0 and <8.7.21 or >=9.0.0 and <9.5.2 | 8.7.21, 9.5.2 |
| CVE-2020-15099 | Exposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMS | high | 8.1 | >=9.0.0 and <9.5.20 or >=10.0.0 and <10.4.6 | 9.5.20, 10.4.6 |
| CVE-2021-21359 | Denial of Service in Page Error Handling | medium | 5.9 | >=10.0.0 and <10.4.14 or >=11.0.0 and <11.1.1 or >=9.0.0 and <9.5.25 | 10.4.14, 11.1.1, 9.5.25 |
| CVE-2010-5104 | TYPO3 Sensitive Information Disclosure via escapeStrForLike method | medium | 0.0 | >=4.2.0 and <4.2.16 or >=4.3.0 and <4.3.9 or >=4.4.0 and <4.4.5 | 4.2.16, 4.3.9, 4.4.5 |
| CVE-2013-7078 | TYPO3 Cross-site scripting (XSS) vulnerability in the Extbase Framework | low | 0.0 | >=4.5.0 and <4.5.31 or >=4.7.0 and <4.7.16 or >=6.1.0 and <6.1.6 or >=6.0.0 and <6.0.11 | 4.5.31, 4.7.16, 6.1.6, 6.0.11 |
| CVE-2021-21355 | Unrestricted File Upload in Form Framework | high | 8.6 | >=10.0.0 and <10.4.14 or >=11.0.0 and <11.1.1 or >=9.0.0 and <9.5.25 | 10.4.14, 11.1.1, 9.5.25 |
| CVE-2022-36104 | TYPO3 CMS vulnerable to Denial of Service in Page Error Handling | medium | 5.9 | >=11.4.0 and <11.5.16 or >=11.0.0 and <11.5.16 | 11.5.16 |
| CVE-2021-21357 | Broken Access Control in Form Framework | high | 8.3 | >=10.0.0 and <10.4.14 or >=11.0.0 and <11.1.1 or >=9.0.0 and <9.5.25 | 10.4.14, 11.1.1, 9.5.25 |
| CVE-2019-12747 | TYPO3 Vulnerable to Insecure Deserialization | high | 8.8 | >=8.0.0 and <8.7.27 or >=9.0.0 and <9.5.8 | 8.7.27, 9.5.8 |
| CVE-2020-11066 | Class destructors causing side-effects when being unserialized in TYPO3 CMS | high | 8.7 | >=9.0.0 and <9.5.17 or >=10.0.0 and <10.4.2 | 9.5.17, 10.4.2 |
| CVE-2019-19848 | TYPO3 Directory Traversal on ZIP extraction | medium | 6.8 | >=10.0.0 and <10.2.2 or >=8.0.0 and <8.7.30 or >=9.0.0 and <9.5.12 or >=10.0.0 and <10.2.1 | 10.2.2, 8.7.30, 9.5.12 |
| CVE-2019-19849 | TYPO3 Insecure Deserialization in Query Generator & Query View | high | 8.8 | >=10.0.0 and <10.2.1 or >=8.0.0 and <8.7.30 or >=9.0.0 and <9.5.12 | 10.2.1, 8.7.30, 9.5.12 |
| CVE-2022-36105 | TYPO3 CMS vulnerable to User Enumeration via Response Timing | medium | 5.3 | >=7.0.0 and <7.6.58 or >=8.0.0 and <8.7.48 or >=9.0.0 and <9.5.37 or >=10.0.0 and <10.4.32 or >=11.0.0 and <11.5.16 | 7.6.58, 8.7.48, 9.5.37, 10.4.32 |
| CVE-2022-31050 | Insufficient Session Expiration in TYPO3's Admin Tool | medium | 6.0 | >=9.0.0 and <9.5.35 or >=10.0.0 and <10.4.29 or >=11.0.0 and <11.5.11 | 9.5.35, 10.4.29, 11.5.11 |
| CVE-2021-41114 | HTTP Host Header Injection | medium | 4.8 | >=11.0.0 and <11.5.0 | 11.5.0 |
| CVE-2020-11063 | Information Disclosure in Password Reset | low | 3.7 | >=10.0.0 and <10.4.2 | 10.4.2 |
| CVE-2013-7080 | TYPO3 is vulnerable to Mass Assignment in the Extension table administration library | medium | 0.0 | >=4.5.0 and <4.5.31 or >=4.6.0 and <4.7.16 or >=6.0.0 and <6.0.11 | 4.5.31, 4.7.16, 6.0.11 |
| CVE-2010-3673 | TYPO3 is vulnerable to Information Disclosure in the HTML mailing API | medium | 5.3 | <4.2.13 or >=4.3 and <4.3.4 or >=4.4 and <4.4.1 | 4.2.13, 4.3.4, 4.4.1 |
| CVE-2013-7077 | TYPO3 Cross-site scripting (XSS) vulnerability in the Backend User Administration Module | medium | 0.0 | >=6.0 and <6.0.12 or >=6.1 and <6.1.7 | 6.0.12, 6.1.7 |
| CVE-2023-30451 | Path Traversal in TYPO3 File Abstraction Layer Storages | medium | 5.5 | >=8.0.0 and <8.7.57 or >=9.0.0 and <9.5.46 or >=10.0.0 and <10.4.43 or >=11.0.0 and <11.5.35 or >=12.0.0 and <12.4.11 or >=13.0.0 and <13.0.1 | 8.7.57, 9.5.46, 10.4.43, 11.5.35 |
| CVE-2022-31047 | Insertion of Sensitive Information into Log File in typo3/cms-core | medium | 5.3 | >=7.0.0 and <7.6.57 or >=8.0.0 and <8.7.47 or >=9.0.0 and <9.5.35 or >=10.0.0 and <10.4.29 or >=11.0.0 and <11.5.11 | 7.6.57, 8.7.47, 9.5.35, 10.4.29 |
| CVE-2021-21338 | Open Redirection in Login Handling | medium | 6.1 | >=6.2.0 and <6.2.57 or >=7.0.0 and <7.6.51 or >=8.0.0 and <8.7.40 or >=10.0.0 and <10.4.14 or >=11.0.0 and <11.1.1 or >=9.0.0 and <9.5.25 | 6.2.57, 7.6.51, 8.7.40, 10.4.14 |
| CVE-2023-38499 | Information Disclosure due to Out-of-scope Site Resolution | low | 3.7 | >=9.4.0 and <9.5.42 or >=10.0.0 and <10.4.39 or >=11.0.0 and <11.5.30 or >=12.0.0 and <12.4.4 | 9.5.42, 10.4.39, 11.5.30, 12.4.4 |
| CVE-2013-7081 | TYPO3 Improper Access Control vulnerability | medium | 0.0 | >=4.5.0 and <4.5.31 or >=4.7.0 and <4.7.16 or >=6.0.0 and <6.0.11 or >=6.1.0 and <6.1.6 | 4.5.31, 4.7.16, 6.0.11, 6.1.6 |
| CVE-2013-4320 | TYPO3 Improper Access Management in the File Abstraction Layer | medium | 0.0 | >=6.0 and <6.0.9 or >=6.1 and <6.1.4 | 6.0.9, 6.1.4 |
| CVE-2020-15241 | Cross-Site Scripting in ternary conditional operator | medium | 4.7 | >=8.0.0 and <8.7.25 or >=9.0.0 and <9.5.6 | 8.7.25, 9.5.6 |
| CVE-2022-36106 | TYPO3 CMS missing check for expiration time of password reset token for backend users | medium | 5.4 | >=10.4.0 and <10.4.32 or >=11.0.0 and <11.5.16 or >=10.0.0 and <10.4.32 | 10.4.32, 11.5.16 |
| CVE-2009-3633 | TYPO3 API function vulnerable to Cross-site Scripting | medium | 0.0 | <=4.0.13 or >=4.1.0 and <4.1.13 or >=4.2.0 and <4.2.10 or >=4.3alpha1 and <4.3beta2 | 4.1.13, 4.2.10, 4.3beta2 |
| CVE-2022-36107 | TYPO3 CMS Stored Cross-Site Scripting via FileDumpController | medium | 5.4 | >=7.0.0 and <7.6.58 or >=8.0.0 and <8.7.48 or >=9.0.0 and <9.5.37 or >=10.0.0 and <10.4.32 or >=11.0.0 and <11.5.16 | 7.6.58, 8.7.48, 9.5.37, 10.4.32 |
| CVE-2022-36108 | TYPO3 CMS vulnerable to Cross-Site Scripting in <f:asset.css> view helper | medium | 5.4 | >=10.3.0 and <10.4.32 or >=11.0.0 and <11.5.16 or >=10.0.0 and <10.4.32 | 10.4.32, 11.5.16 |
| CVE-2021-21339 | Cleartext storage of session identifier | medium | 5.9 | >=6.2.0 and <6.2.57 or >=7.0.0 and <7.6.51 or >=8.0.0 and <8.7.40 or >=10.0.0 and <10.4.14 or >=11.0.0 and <11.1.1 or >=9.0.0 and <9.5.25 | 6.2.57, 7.6.51, 8.7.40, 10.4.14 |
| CVE-2021-21340 | Cross-Site Scripting in Content Preview | medium | 5.4 | >=10.0.0 and <10.4.14 or >=11.0.0 and <11.1.1 | 10.4.14, 11.1.1 |
| CVE-2021-21358 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-form | medium | 5.4 | >=10.0.0 and <10.4.14 or >=11.0.0 and <11.1.1 | 10.4.14, 11.1.1 |
| CVE-2021-21370 | Cross-Site Scripting in Content Preview (CType menu) | medium | 5.4 | >=10.0.0 and <10.4.14 or >=11.0.0 and <11.1.1 or >=9.0.0 and <9.5.25 | 10.4.14, 11.1.1, 9.5.25 |
| CVE-2019-19850 | TYPO3 SQL Injection in low-level Query Generator | medium | 5.5 | >=8.0 and <8.7.30 or >=9.0 and <9.5.12 or >=10.0 and <10.2.2 or >=10.0.0 and <10.2.1 or >=8.0.0 and <8.7.30 or >=9.0.0 and <9.5.12 | 8.7.30, 9.5.12, 10.2.2 |
| CVE-2022-23503 | TYPO3 CMS vulnerable to Arbitrary Code Execution via Form Framework | high | 7.5 | >=8.0.0 and <8.7.49 or >=9.0.0 and <9.5.38 or >=10.0.0 and <10.4.33 or >=11.0.0 and <11.5.20 or >=12.0.0 and <12.1.1 | 8.7.49, 9.5.38, 10.4.33, 11.5.20 |
| CVE-2023-24814 | TYPO3 is vulnerable to Cross-Site Scripting via frontend rendering | high | 8.8 | >=12.0.0 and <12.2.0 or >=11.0.0 and <11.5.23 or >=10.0.0 and <10.4.36 or >=9.0.0 and <9.5.40 or >=8.7.0 and <8.7.51 or >=10.0.0 and <10.4.35 | 12.2.0, 11.5.23, 10.4.36, 9.5.40 |
| CVE-2021-32767 | Information Disclosure in User Authentication | medium | 5.3 | >=7.0.0 and <7.6.52 or >=8.0.0 and <8.7.41 or >=9.0.0 and <9.5.28 or >=10.0.0 and <10.4.18 or >=11.0.0 and <11.3.1 | 7.6.52, 8.7.41, 9.5.28, 10.4.18 |
| CVE-2022-36020 | TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting Protection | medium | 6.1 | >=10.0.0 and <10.4.32 or >=11.0.0 and <11.5.16 | 10.4.32, 11.5.16 |
| CVE-2022-31048 | Cross-Site Scripting in TYPO3's Form Framework | medium | 5.4 | >=8.0.0 and <8.7.47 or >=9.0.0 and <9.5.35 or >=10.0.0 and <10.4.29 or >=11.0.0 and <11.5.11 | 8.7.47, 9.5.35, 10.4.29, 11.5.11 |
| CVE-2022-31049 | Cross-Site Scripting in TYPO3's Frontend Login Mailer | medium | 5.4 | >=9.0.0 and <9.5.35 or >=10.0.0 and <10.4.29 or >=11.0.0 and <11.5.11 | 9.5.35, 10.4.29, 11.5.11 |
| CVE-2020-11069 | Backend Same-Site Request Forgery in TYPO3 CMS | high | 8.0 | >=9.0.0 and <9.5.17 or >=10.0.0 and <10.4.2 | 9.5.17, 10.4.2 |
| CVE-2022-23500 | TYPO3 CMS vulnerable to Denial of Service in Page Error Handling | medium | 5.9 | >=9.0.0 and <9.5.38 or >=10.0.0 and <10.4.33 or >=11.0.0 and <11.5.20 | 9.5.38, 10.4.33, 11.5.20 |
| CVE-2021-32768 | Cross-Site Scripting via Rich-Text Content | medium | 6.1 | >=7.0.0 and <7.6.53 or >=8.0.0 and <8.7.42 or >=10.0.0 and <10.4.19 or >=11.0.0 and <11.3.2 or >=9.0.0 and <9.5.29 | 7.6.53, 8.7.42, 10.4.19, 11.3.2 |
| CVE-2020-26227 | Cross-Site Scripting in Fluid view helpers | medium | 6.1 | >=9.0.0 and <9.5.23 or >=10.0.0 and <10.4.10 or >=8.7.0 and <8.7.38 | 9.5.23, 10.4.10, 8.7.38 |
| CVE-2019-12748 | Typo3 Cross-Site Scripting in Link Handling | medium | 6.1 | >=8.0.0 and <8.7.27 or >=9.0.0 and <9.5.8 | 8.7.27, 9.5.8 |
| CVE-2020-26228 | Cleartext storage of session identifier | high | 8.1 | >=9.0.0 and <9.5.23 or >=10.0.0 and <10.4.10 or >=8.7.0 and <8.7.38 | 9.5.23, 10.4.10, 8.7.38 |
| CVE-2020-26229 | XML External Entity in Dashboard Widget | low | 3.7 | >=10.0.0 and <10.4.10 | 10.4.10 |
| CVE-2021-41113 | Cross-Site-Request-Forgery in Backend | high | 8.8 | >=11.2.0 and <11.5.0 | 11.5.0 |
| CVE-2022-31046 | Information Disclosure via Export Module | medium | 4.3 | >=7.0.0 and <7.6.57 or >=8.0.0 and <8.7.47 or >=9.0.0 and <9.5.35 or >=10.0.0 and <10.4.29 or >=11.0.0 and <11.5.11 | 7.6.57, 8.7.47, 9.5.35, 10.4.29 |
| CVE-2021-32667 | Cross-Site Scripting in Page Preview | medium | 6.4 | >=9.0.0 and <9.5.28 or >=10.0.0 and <10.4.18 or >=11.0.0 and <11.3.1 | 9.5.28, 10.4.18, 11.3.1 |
| CVE-2021-32669 | Cross-Site Scripting in Backend Grid View | medium | 6.4 | >=8.0.0 and <8.7.41 or >=9.0.0 and <9.5.28 or >=10.0.0 and <10.4.18 or >=11.0.0 and <11.3.1 | 8.7.41, 9.5.28, 10.4.18, 11.3.1 |
| CVE-2021-32668 | Cross-Site Scripting in Query Generator & Query View | medium | 6.4 | >=8.0.0 and <8.7.41 or >=9.0.0 and <9.5.28 or >=10.0.0 and <10.4.18 or >=11.0.0 and <11.3.1 | 8.7.41, 9.5.28, 10.4.18, 11.3.1 |
| CVE-2024-34355 | TYPO3 vulnerable to an HTML Injection in the History Module | low | 3.5 | >=13.0.0 and <13.1.1 | 13.1.1 |
| CVE-2023-47127 | TYPO3 vulnerable to Weak Authentication in Session Handling | medium | 4.2 | >=8.0.0 and <8.7.55 or >=9.0.0 and <9.5.44 or >=10.0.0 and <10.4.41 or >=11.0.0 and <11.5.33 or >=12.0.0 and <12.4.8 | 8.7.55, 9.5.44, 10.4.41, 11.5.33 |
| CVE-2024-25118 | TYPO3 Backend Forms vulnerable to Information Disclosure of Hashed Passwords | medium | 4.3 | >=8.0.0 and <8.7.57 or >=9.0.0 and <9.5.46 or >=10.0.0 and <10.4.43 or >=11.0.0 and <11.5.35 or >=12.0.0 and <12.4.11 or >=13.0.0 and <13.0.1 | 8.7.57, 9.5.46, 10.4.43, 11.5.35 |
| CVE-2022-23504 | TYPO3 CMS vulnerable to Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration | medium | 5.7 | >=9.0.0 and <9.5.38 or >=10.0.0 and <10.4.33 or >=11.0.0 and <11.5.20 or >=12.0.0 and <12.1.1 | 9.5.38, 10.4.33, 11.5.20, 12.1.1 |
| CVE-2024-25120 | TYPO3 vulnerable to Improper Access Control of Resources Referenced by t3:// URI Scheme | medium | 4.3 | >=8.0.0 and <8.7.57 or >=9.0.0 and <9.5.46 or >=10.0.0 and <10.4.43 or >=11.0.0 and <11.5.35 or >=12.0.0 and <12.4.11 or >=13.0.0 and <13.0.1 | 8.7.57, 9.5.46, 10.4.43, 11.5.35 |
| CVE-2020-11064 | Cross-Site Scripting in TYPO3 CMS Form Engine | medium | 5.4 | >=9.0.0 and <9.5.17 or >=10.0.0 and <10.4.2 | 9.5.17, 10.4.2 |
| CVE-2020-11065 | Cross-Site Scripting in TYPO3 CMS Link Handling | medium | 5.4 | >=10.0.0 and <10.4.2 or >=9.0.0 and <9.5.17 | 10.4.2, 9.5.17 |
| CVE-2022-23501 | TYPO3 CMS vulnerable to Weak Authentication in Frontend Login | medium | 5.9 | <8.7.49 or >=9.0.0 and <9.5.38 or >=10.0.0 and <10.4.33 or >=11.0.0 and <11.5.20 or >=12.0.0 and <12.1.1 | 8.7.49, 9.5.38, 10.4.33, 11.5.20 |
| CVE-2024-34356 | TYPO3 vulnerable to Cross-Site Scripting in the Form Manager Module | medium | 5.4 | >=9.0.0 and <9.5.48 or >=10.0.0 and <10.4.45 or >=11.0.0 and <11.5.37 or >=12.0.0 and <12.4.15 or >=13.0.0 and <13.1.1 | 9.5.48, 10.4.45, 11.5.37, 12.4.15 |
| CVE-2024-34357 | TYPO3 vulnerable to Cross-Site Scripting in the ShowImageController | medium | 5.4 | >=9.0.0 and <9.5.48 or >=10.0.0 and <10.4.45 or >=11.0.0 and <11.5.37 or >=12.0.0 and <12.4.15 or >=13.0.0 and <13.1.1 | 9.5.48, 10.4.45, 11.5.37, 12.4.15 |
| CVE-2024-25121 | TYPO3 vulnerable to Improper Access Control Persisting File Abstraction Layer Entities via Data Handler | high | 7.1 | >=8.0.0 and <8.7.57 or >=9.0.0 and <9.5.46 or >=10.0.0 and <10.4.43 or >=11.0.0 and <11.5.35 or >=12.0.0 and <12.4.11 or >=13.0.0 and <13.0.1 | 8.7.57, 9.5.46, 10.4.43, 11.5.35 |
| CVE-2024-34358 | TYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageController | medium | 5.3 | >=9.0.0 and <9.5.48 or >=10.0.0 and <10.4.45 or >=11.0.0 and <11.5.37 or >=12.0.0 and <12.4.15 or >=13.0.0 and <13.1.1 | 9.5.48, 10.4.45, 11.5.37, 12.4.15 |
| CVE-2022-23499 | TYPO3-CORE-SA-2022-017: By-passing Cross-Site Scripting Protection in HTML Sanitizer | unknown | 0.0 | >=10.0.0 and <10.4.33 or >=11.0.0 and <11.5.20 or >=12.0.0 and <12.1.1 | 10.4.33, 11.5.20, 12.1.1 |
| CVE-2025-47940 | TYPO3 Allows Privilege Escalation to System Maintainer | high | 7.2 | >=10.4.0 and <10.4.50 or >=11.0.0 and <11.5.44 or >=12.0.0 and <12.4.31 or >=13.0.0 and <13.4.12 | 10.4.50, 11.5.44, 12.4.31, 13.4.12 |
| CVE-2022-23502 | TYPO3 CMS vulnerable to Insufficient Session Expiration after Password Reset | medium | 5.4 | >=10.0.0 and <10.4.33 or >=11.0.0 and <11.5.20 or >=12.0.0 and <12.1.1 | 10.4.33, 11.5.20, 12.1.1 |
| CVE-2024-25119 | TYPO3 Install Tool vulnerable to Information Disclosure of Encryption Key | medium | 4.9 | >=8.0.0 and <8.7.57 or >=9.0.0 and <9.5.46 or >=10.0.0 and <10.4.43 or >=11.0.0 and <11.5.35 or >=12.0.0 and <12.4.11 or >=13.0.0 and <13.0.1 | 8.7.57, 9.5.46, 10.4.43, 11.5.35 |
| CVE-2026-49738 | TYPO3 CMS has Broken Access Control in its File Abstraction Layer | low | 0.0 | <10.4.57 or >=11.0.0 and <11.5.51 or >=12.0.0 and <12.4.46 or >=13.0.0 and <13.4.31 or >=14.0.0 and <14.3.3 | 10.4.57, 11.5.51, 12.4.46, 13.4.31 |
| CVE-2026-49742 | TYPO3 CMS has Broken Access Control in its Media Module | high | 0.0 | >=11.0.0 and <11.5.51 or >=12.0.0 and <12.4.46 or >=13.0.0 and <13.4.31 or >=14.0.0 and <14.3.3 | 11.5.51, 12.4.46, 13.4.31, 14.3.3 |
| CVE-2025-47937 | TYPO3 Allows Information Disclosure via DBAL Restriction Handling | low | 3.7 | >=9.0.0 and <9.5.51 or >=10.0.0 and <10.4.50 or >=11.0.0 and <11.5.44 or >=12.0.0 and <12.4.31 or >=13.0.0 and <13.4.12 | 9.5.51, 10.4.50, 11.5.44, 12.4.31 |
| CVE-2026-47347 | TYPO3 CMS has an Open Redirect Vulnerability via Core Utilities | medium | 0.0 | <10.4.57 or >=11.0.0 and <11.5.51 or >=12.0.0 and <12.4.46 or >=13.0.0 and <13.4.31 or >=14.0.0 and <14.3.3 | 10.4.57, 11.5.51, 12.4.46, 13.4.31 |
| CVE-2025-47938 | TYPO3 Unverified Password Change for Backend Users | low | 3.8 | >=9.0.0 and <9.5.51 or >=10.0.0 and <10.4.50 or >=11.0.0 and <11.5.44 or >=12.0.0 and <12.4.31 or >=13.0.0 and <13.4.12 | 9.5.51, 10.4.50, 11.5.44, 12.4.31 |
| CVE-2026-47348 | TYPO3 CMS has Cross-Site Scripting in Indexed Search | medium | 0.0 | >=13.0.0 and <13.4.31 or >=14.0.0 and <14.3.3 | 13.4.31, 14.3.3 |
| CVE-2026-47346 | TYPO3 CMS has Broken Access Control in its Form Framework | high | 0.0 | <10.4.57 or >=11.0.0 and <11.5.51 or >=12.0.0 and <12.4.46 or >=13.0.0 and <13.4.31 or >=14.0.0 and <14.3.3 | 10.4.57, 11.5.51, 12.4.46, 13.4.31 |
| CVE-2024-55892 | TYPO3 Potential Open Redirect via Parsing Differences | medium | 4.8 | >=9.0.0 and <9.5.49 or >=10.0.0 and <10.4.48 or >=11.0.0 and <11.5.42 or >=12.0.0 and <12.4.25 or >=13.0.0 and <13.4.3 | 9.5.49, 10.4.48, 11.5.42, 12.4.25 |
| CVE-2026-49741 | TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework | high | 0.0 | >=14.0.0 and <14.3.3 | 14.3.3 |
| CVE-2026-19418 | TYPO3 CMS - Broken Access Control in Backend and Install Tool | high | 0.0 | >=14.0.0 and <14.3.6 or >=13.0.0 and <13.4.34 | 14.3.6, 13.4.34 |
| CVE-2026-11607 | TYPO3 CMS has Broken Access Control in its Form Framework | high | 0.0 | <10.4.57 or >=11.0.0 and <11.5.51 or >=12.0.0 and <12.4.46 or >=13.0.0 and <13.4.31 or >=14.0.0 and <14.3.3 | 10.4.57, 11.5.51, 12.4.46, 13.4.31 |
| CVE-2026-47343 | TYPO3 CMS: Destructive Actions on File Mount Folders | high | 0.0 | <10.4.57 or >=11.0.0 and <11.5.51 or >=12.0.0 and <12.4.46 or >=13.0.0 and <13.4.31 or >=14.0.0 and <14.3.3 | 10.4.57, 11.5.51, 12.4.46, 13.4.31 |
| CVE-2026-47349 | TYPO3 CMS has Broken Access Control in the Recycler Module | medium | 0.0 | <10.4.57 or >=11.0.0 and <11.5.51 or >=12.0.0 and <12.4.46 or >=13.0.0 and <13.4.31 or >=14.0.0 and <14.3.3 | 10.4.57, 11.5.51, 12.4.46, 13.4.31 |
| CVE-2026-47350 | TYPO3 CMS has Broken Access Control in its DataHandler | medium | 0.0 | >=13.0.0 and <13.4.31 or >=14.0.0 and <14.3.3 | 13.4.31, 14.3.3 |
| CVE-2026-47351 | TYPO3 CMS: Broken Access Control in Media Module | medium | 0.0 | <10.4.57 or >=11.0.0 and <11.5.51 or >=12.0.0 and <12.4.46 or >=13.0.0 and <13.4.31 or >=14.0.0 and <14.3.3 | 10.4.57, 11.5.51, 12.4.46, 13.4.31 |
| CVE-2026-47352 | TYPO3 CMS has Broken Access Control in Backend API | medium | 0.0 | <10.4.57 or >=11.0.0 and <11.5.51 or >=12.0.0 and <12.4.46 or >=13.0.0 and <13.4.31 or >=14.0.0 and <14.3.3 | 10.4.57, 11.5.51, 12.4.46, 13.4.31 |
| CVE-2025-59016 | TYPO3 CMS exposes sensitive information in an error message | medium | 0.0 | >=9.0.0 and <12.4.37 or >=10.0.0 and <12.4.37 or >=11.0.0 and <12.4.37 or >=12.0.0 and <12.4.37 or >=13.0.0 and <13.4.18 | 12.4.37, 13.4.18 |
| CVE-2026-49740 | TYPO3 CMS has Insecure Deserialization via Core API | medium | 0.0 | <10.4.57 or >=11.0.0 and <11.5.51 or >=12.0.0 and <12.4.46 or >=13.0.0 and <13.4.31 or >=14.0.0 and <14.3.3 | 10.4.57, 11.5.51, 12.4.46, 13.4.31 |
| CVE-2025-59015 | TYPO3 CMS uses insufficient entropy when generating passwords | medium | 6.5 | >=12.0.0 and <12.4.37 or >=13.0.0 and <13.4.18 | 12.4.37, 13.4.18 |
| CVE-2025-59013 | TYPO3 CMS has an open‑redirect vulnerability | medium | 0.0 | >=9.0.0 and <12.4.37 or >=10.0.0 and <12.4.37 or >=11.0.0 and <12.4.37 or >=12.0.0 and <12.4.37 or >=13.0.0 and <13.4.18 | 12.4.37, 13.4.18 |
| CVE-2026-0859 | TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool | medium | 0.0 | >=14.0.0 and <14.0.2 or >=13.0.0 and <13.4.23 or >=12.0.0 and <12.4.41 or >=11.0.0 and <11.5.49 or >=10.0.0 and <10.4.55 | 14.0.2, 13.4.23, 12.4.41, 11.5.49 |
| CVE-2025-47939 | TYPO3 Allows Unrestricted File Upload in File Abstraction Layer | medium | 5.4 | >=9.0.0 and <9.5.51 or >=10.0.0 and <10.4.50 or >=11.0.0 and <11.5.44 or >=12.0.0 and <12.4.31 or >=13.0.0 and <13.4.12 | 9.5.51, 10.4.50, 11.5.44, 12.4.31 |
| GHSA-cc97-g92w-jm65 | TYPO3 CMS Insecure Deserialization & Arbitrary Code Execution | critical | 9.8 | >=8.0.0 and <8.7.17 or >=9.0.0 and <9.3.2 or >=7.0.0 and <7.6.30 | 8.7.17, 9.3.2, 7.6.30 |
| GHSA-f9hr-7cfq-mjg2 | TYPO3 Arbitrary Code Execution via File List Module | high | 8.8 | >=8.0.0 and <8.7.23 or >=9.0.0 and <9.5.4 | 8.7.23, 9.5.4 |
| GHSA-x428-565f-8xj2 | TYPO3 Arbitrary Code Execution and Cross-Site Scripting in Backend API | high | 8.8 | >=8.0.0 and <8.7.27 or >=9.0.0 and <9.5.8 | 8.7.27, 9.5.8 |
| GHSA-82vp-jr39-4j2j | TYPO3 Security Misconfiguration in Frontend Session Handling | high | 8.2 | >=8.0.0 and <8.7.27 or >=9.0.0 and <9.5.8 | 8.7.27, 9.5.8 |
| GHSA-5h5v-m596-r6rf | TYPO3 Possible Insecure Deserialization in Extbase Request Handling | high | 8.1 | >=8.0.0 and <8.7.30 or >=9.0.0 and <9.5.12 | 8.7.30, 9.5.12 |
| GHSA-45wj-jv2h-jwrf | TYPO3 CMS Privilege Escalation and SQL Injection | high | 7.5 | >=8.5.0 and <8.7.17 or >=9.0.0 and <9.3.2 | 8.7.17, 9.3.2 |
| GHSA-96jg-pmc4-cx39 | TYPO3 CMS Insecure Deserialization | high | 7.5 | >=8.5.0 and <8.7.17 or >=9.0.0 and <9.3.1 | 8.7.17, 9.3.1 |
| GHSA-hjx5-v9xg-7h25 | TYPO3 Denial of Service in Frontend Record Registration | high | 7.5 | >=8.0.0 and <8.7.21 or >=7.0.0 and <7.6.32 | 8.7.21, 7.6.32 |
| GHSA-ppvg-hw62-6ph9 | TYPO3 Security Misconfiguration in Install Tool Cookie | high | 7.5 | >=8.0.0 and <8.7.21 or >=9.0.0 and <9.5.2 or >=7.0.0 and <7.6.32 | 8.7.21, 9.5.2, 7.6.32 |
| GHSA-rxc9-f2x6-qh4w | TYPO3 Security Misconfiguration for Backend User Accounts | high | 7.5 | >=8.0.0 and <8.7.23 or >=9.0.0 and <9.5.4 | 8.7.23, 9.5.4 |
| GHSA-x4rj-f7m6-42c3 | TYPO3 CMS Authentication Bypass vulnerability | high | 7.5 | >=8.0.0 and <8.7.17 or >=9.0.0 and <9.3.2 or >=7.0.0 and <7.6.30 | 8.7.17, 9.3.2, 7.6.30 |
| GHSA-9rx9-7fmh-gj3g | TYPO3 Broken Access Control in Localization Handling | medium | 6.5 | >=8.0.0 and <8.7.23 | 8.7.23 |
| GHSA-xmgr-jff3-fcfv | TYPO3 Security Misconfiguration in User Session Handling | medium | 6.5 | >=8.0.0 and <8.7.25 or >=9.0.0 and <9.5.6 | 8.7.25, 9.5.6 |
| GHSA-4459-qrcc-vfcf | TYPO3 Cross-Site Scripting in Form Framework | medium | 6.1 | >=8.5.0 and <8.7.23 or >=9.0.0 and <9.5.4 | 8.7.23, 9.5.4 |
| GHSA-4ppr-jw47-9qm5 | TYPO3 Cross-Site Scripting in Link Handling | medium | 6.1 | >=10.0.0 and <10.2.1 or >=8.0.0 and <8.7.30 or >=9.0.0 and <9.5.12 | 10.2.1, 8.7.30, 9.5.12 |
| GHSA-6xwf-7rfm-4gwc | TYPO3 Cross-Site Scripting in Filelist Module | medium | 6.1 | >=10.0.0 and <10.2.1 or >=8.0.0 and <8.7.30 or >=9.0.0 and <9.5.12 | 10.2.1, 8.7.30, 9.5.12 |
| GHSA-76r3-m635-p3vc | TYPO3 Cross-Site Scripting in Language Pack Handling | medium | 6.1 | >=9.2.0 and <9.5.4 | 9.5.4 |
| GHSA-8c25-vj2w-p72j | TYPO3 Cross-Site Scripting in Frontend User Login | medium | 6.1 | >=8.0.0 and <8.7.21 or >=9.0.0 and <9.5.2 or >=7.1.0 and <7.6.32 | 8.7.21, 9.5.2, 7.6.32 |
| GHSA-95qm-3xp7-vfj5 | TYPO3 Cross-Site Scripting in Form Framework validation handling | medium | 6.1 | >=10.0.0 and <10.2.1 or >=8.0.0 and <8.7.30 or >=9.0.0 and <9.5.12 | 10.2.1, 8.7.30, 9.5.12 |
| GHSA-g4c9-qfvw-fmr4 | TYPO3 Cross-Site Scripting in Backend Modal Component | medium | 6.1 | >=8.0.0 and <8.7.21 or >=9.0.0 and <9.5.2 or >=7.1.0 and <7.6.32 | 8.7.21, 9.5.2, 7.6.32 |
| GHSA-gqqf-g5r7-84vf | TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting Protection | medium | 6.1 | >=7.0.0 and <7.6.58 or >=8.0.0 and <8.7.48 or >=9.0.0 and <9.5.37 or >=10.0.0 and <10.4.32 or >=11.0.0 and <11.5.16 | 7.6.58, 8.7.48, 9.5.37, 10.4.32 |
| GHSA-wg8h-gxf4-g4gh | TYPO3 Cross-Site Scripting in Online Media Asset Rendering | medium | 6.1 | >=8.0.0 and <8.7.21 or >=9.0.0 and <9.5.2 | 8.7.21, 9.5.2 |
| GHSA-rv8r-8mh5-5376 | TYPO3 Information Disclosure in Backend User Interface | medium | 5.4 | >=8.0.0 and <8.7.27 or >=9.0.0 and <9.5.8 | 8.7.27, 9.5.8 |
| GHSA-29m4-mx89-3mjg | TYPO3 Denial of Service in Online Media Asset Handling | medium | 5.3 | >=8.0.0 and <8.7.21 or >=9.0.0 and <9.5.2 or >=7.0.0 and <7.6.32 | 8.7.21, 9.5.2, 7.6.32 |
| GHSA-66c2-7g4p-wx4p | TYPO3 Information Disclosure in Install Tool | medium | 5.3 | >=8.0.0 and <8.7.21 or >=9.0.0 and <9.5.2 or >=7.0.0 and <7.6.32 | 8.7.21, 9.5.2, 7.6.32 |
| GHSA-p2h4-7fp3-cmh8 | TYPO3 Disclosure of Information about Installed Extensions | medium | 5.3 | >=8.0.0 and <8.7.23 or >=9.0.0 and <9.5.4 | 8.7.23, 9.5.4 |
| GHSA-wj85-rg5g-v8jm | TYPO3 Information Disclosure in User Authentication | medium | 5.3 | >=9.0.0 and <9.5.6 | 9.5.6 |
| GHSA-g776-759r-pf6x | TYPO3 Broken Access Control in Import Module | medium | 4.3 | >=9.3.0 and <9.5.8 | 9.5.8 |
| GHSA-wvvp-jwf5-qcpc | TYPO3 Information Disclosure in Page Tree | medium | 4.3 | >=9.0.0 and <9.5.6 | 9.5.6 |
| 2018-07-12-1 | Authentication Bypass in TYPO3 CMS | unknown | 0.0 | >=8.0.0 and <8.7.17 or >=9.0.0 and <9.3.2 | 8.7.17, 9.3.2 |
| 2018-07-12-2 | Insecure Deserialization & Arbitrary Code Execution in TYPO3 CMS | unknown | 0.0 | >=8.0.0 and <8.7.17 or >=9.0.0 and <9.3.2 | 8.7.17, 9.3.2 |
| 2018-07-12-3 | Privilege Escalation & SQL Injection in TYPO3 CMS | unknown | 0.0 | >=8.5.0 and <8.7.17 or >=9.0.0 and <9.3.2 | 8.7.17, 9.3.2 |
| 2018-07-12-4 | Insecure Deserialization in TYPO3 CMS | unknown | 0.0 | >=8.5.0 and <8.7.17 or >=9.0.0 and <9.3.2 | 8.7.17, 9.3.2 |
| 2018-12-11-1 | Cross-Site Scripting in Online Media Asset Rendering | unknown | 0.0 | >=8.0.0 and <8.7.21 or >=9.0.0 and <9.5.2 | 8.7.21, 9.5.2 |
| 2018-12-11-2 | Cross-Site Scripting in Backend Modal Component | unknown | 0.0 | >=8.0.0 and <8.7.21 or >=9.0.0 and <9.5.2 | 8.7.21, 9.5.2 |
| 2018-12-11-3 | Cross-Site Scripting in Frontend User Login | unknown | 0.0 | >=8.0.0 and <8.7.21 or >=9.0.0 and <9.5.2 | 8.7.21, 9.5.2 |
| 2018-12-11-4 | Security Misconfiguration in Install Tool Cookie | unknown | 0.0 | >=8.0.0 and <8.7.21 or >=9.0.0 and <9.5.2 | 8.7.21, 9.5.2 |
| 2018-12-11-5 | Information Disclosure in Install Tool | unknown | 0.0 | >=8.0.0 and <8.7.21 or >=9.0.0 and <9.5.2 | 8.7.21, 9.5.2 |
| 2018-12-11-6 | Denial of Service in Online Media Asset Handling | unknown | 0.0 | >=8.0.0 and <8.7.21 or >=9.0.0 and <9.5.2 | 8.7.21, 9.5.2 |
| 2018-12-11-7 | Denial of Service in Frontend Record Registration | unknown | 0.0 | >=8.0.0 and <8.7.21 | 8.7.21 |
| 2019-01-22-1 | Information Disclosure of Installed Extensions | unknown | 0.0 | >=8.0.0 and <8.7.23 or >=9.0.0 and <9.5.4 | 8.7.23, 9.5.4 |
| 2019-01-22-2 | Security Misconfiguration for Backend User Accounts | unknown | 0.0 | >=8.0.0 and <8.7.23 or >=9.0.0 and <9.5.4 | 8.7.23, 9.5.4 |
| 2019-01-22-3 | Broken Access Control in Localization Handling | unknown | 0.0 | >=8.0.0 and <8.7.23 | 8.7.23 |
| 2019-01-22-4 | Cross-Site Scripting in Fluid ViewHelpers | unknown | 0.0 | >=8.0.0 and <8.7.23 or >=9.0.0 and <9.5.4 | 8.7.23, 9.5.4 |
| 2019-01-22-6 | Cross-Site Scripting in Form Framework | unknown | 0.0 | >=8.0.0 and <8.7.23 or >=9.0.0 and <9.5.4 | 8.7.23, 9.5.4 |
| 2019-01-22-7 | Arbitrary Code Execution via File List Module | unknown | 0.0 | >=8.0.0 and <8.7.23 or >=9.0.0 and <9.5.4 | 8.7.23, 9.5.4 |
| 2019-01-22-8 | Cross-Site Scripting in Language Pack Handling | unknown | 0.0 | >=9.0.0 and <9.5.4 | 9.5.4 |
| 2019-05-07-2 | Security Misconfiguration in User Session Handling | unknown | 0.0 | >=8.0.0 and <8.7.25 or >=9.0.0 and <9.5.6 | 8.7.25, 9.5.6 |
| 2019-05-07-4 | Information Disclosure in Page Tree | unknown | 0.0 | >=9.0.0 and <9.5.6 | 9.5.6 |
| 2019-05-07-5 | Information Disclosure in User Authentication | unknown | 0.0 | >=9.0.0 and <9.5.6 | 9.5.6 |
| 2019-06-25-1 | Information Disclosure in Backend User Interface | unknown | 0.0 | >=8.0.0 and <8.7.27 or >=9.0.0 and <9.5.8 | 8.7.27, 9.5.8 |
| 2019-06-25-3 | Security Misconfiguration in Frontend Session Handling | unknown | 0.0 | >=8.0.0 and <8.7.27 or >=9.0.0 and <9.5.8 | 8.7.27, 9.5.8 |
| 2019-06-25-4 | Arbitrary Code Execution and Cross-Site Scripting in Backend API | unknown | 0.0 | >=8.0.0 and <8.7.27 or >=9.0.0 and <9.5.8 | 8.7.27, 9.5.8 |
| 2019-06-25-7 | Broken Access Control in Import Module | unknown | 0.0 | >=9.0.0 and <9.5.8 | 9.5.8 |
| 2019-12-17-1 | Cross-Site Scripting in Form Framework validation handling | unknown | 0.0 | >=10.0.0 and <10.2.1 or >=8.0.0 and <8.7.30 or >=9.0.0 and <9.5.12 | 10.2.1, 8.7.30, 9.5.12 |
| 2019-12-17-2 | Cross-Site Scripting in Link Handling | unknown | 0.0 | >=10.0.0 and <10.2.1 or >=8.0.0 and <8.7.30 or >=9.0.0 and <9.5.12 | 10.2.1, 8.7.30, 9.5.12 |
| 2019-12-17-3 | Cross-Site Scripting in Filelist Module | unknown | 0.0 | >=10.0.0 and <10.2.1 or >=8.0.0 and <8.7.30 or >=9.0.0 and <9.5.12 | 10.2.1, 8.7.30, 9.5.12 |
| 2019-12-17-7 | Possible Insecure Deserialization in Extbase Request Handling | unknown | 0.0 | >=8.0.0 and <8.7.30 or >=9.0.0 and <9.5.12 | 8.7.30, 9.5.12 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked