Composer typo3/cms-install has 6 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2009-3636 | Typo3 API Install Tool vulnerable to Cross-site Scripting | medium | 0.0 | <=4.0.13 or >=4.1.0 and <4.1.13 or >=4.2.0 and <4.2.10 or >=4.3alpha1 and <4.3beta2 | 4.1.13, 4.2.10, 4.3beta2 |
| CVE-2010-3671 | TYPO3 is vulnerable to Session Fixation | medium | 6.5 | <4.1.14 or >=4.2.0 and <4.2.13 or >=4.3.0 and <4.3.4 or >=4.4.0 and <4.4.1 | 4.1.14, 4.2.13, 4.3.4, 4.4.1 |
| CVE-2010-3666 | TYPO3 is vulnerable to Insecure randomness in uniqid function | medium | 5.3 | <4.1.14 or >=4.2.0 and <4.2.13 or >=4.3.0 and <4.3.4 or >=4.4.0 and <4.4.1 | 4.1.14, 4.2.13, 4.3.4, 4.4.1 |
| CVE-2010-5100 | TYPO3 Cross-Site Scripting vulnerability in the Install Tool | low | 0.0 | >=4.2.0 and <4.2.16 or >=4.3.0 and <4.3.9 or >=4.4.0 and <4.4.5 | 4.2.16, 4.3.9, 4.4.5 |
| CVE-2023-47126 | Information Disclosure in typo3/cms-install tool | low | 3.7 | >=12.2.0 and <12.4.8 | 12.4.8 |
| CVE-2024-55891 | TYPO3 Information Disclosure via Exception Handling/Logger | low | 3.1 | >=13.4.2 and <13.4.3 | 13.4.3 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked