Affected version lines
Known vulnerabilities
| CVE | Title | Affected versions | CVSS | Exploited | EPSS | Published |
|---|---|---|---|---|---|---|
| CVE-2026-109162 | TYPO3 CMS - Security Misconfiguration in Form Framework | ≥ 14.0.0 < 14.3.9 | 6.3 | — | 2026-10-13 | |
| CVE-2026-77132 | TYPO3 CMS - Information Disclosure via Backend Localization Wizard | ≥ 10.0.0 < 10.4.60 ≥ 11.0.0 < 11.5.54 ≥ 12.0.0 < 12.4.49 | 5.3 | — | 2026-09-08 | |
| CVE-2026-85400 | TYPO3 CMS - Missing Authorization in lowlevel commands | ≥ 14.2.0 < 14.3.7 | 7.5 | — | 2026-09-08 | |
| CVE-2026-19418 | TYPO3 CMS - Broken Access Control in Backend and Install Tool | ≥ 13.0.0 < 13.4.34 ≥ 14.0.0 < 14.3.6 | 7.3 | — | 2026-08-11 | |
| CVE-2026-15305 | TYPO3 CMS - Unrestricted File Upload in Form Framework | ≥ 14.2.0 < 14.3.5 | 6.3 | — | 2026-07-14 | |
| CVE-2026-49742 | TYPO3 CMS - Broken Access Control in Media Module | ≥ 11.0.0 < 11.5.51 ≥ 12.0.0 < 12.4.46 ≥ 13.0.0 < 13.4.31 | 7.1 | — | 2026-06-09 | |
| CVE-2026-49741 | TYPO3 CMS - Privilege Escalation & SQL Injection in Form Framework | ≥ 14.0.0 < 14.3.3 | 8.7 | — | 2026-06-09 | |
| CVE-2026-49740 | TYPO3 CMS - Insecure Deserialization in Core API | < 10.4.57 ≥ 11.0.0 < 11.5.51 ≥ 12.0.0 < 12.4.46 | 6.3 | — | 2026-06-09 | |
| CVE-2026-49738 | TYPO3 CMS - Broken Access Control in File Abstraction Layer | < 10.4.57 ≥ 11.0.0 < 11.5.51 ≥ 12.0.0 < 12.4.46 | 2.1 | — | 2026-06-09 | |
| CVE-2026-47352 | TYPO3 CMS - Broken Access Control in Backend API | < 10.4.57 ≥ 11.0.0 < 11.5.51 ≥ 12.0.0 < 12.4.46 | 5.3 | — | 2026-06-09 | |
| CVE-2026-47351 | TYPO3 CMS - Broken Access Control in Clipboard | ≥ 10.4.0 < 13.4.31 ≥ 14.0.0 < 14.3.3 | 5.3 | — | 2026-06-09 | |
| CVE-2026-47350 | TYPO3 CMS - Broken Access Control in DataHandler | ≥ 13.0.0 < 13.4.31 ≥ 14.0.0 < 14.3.3 | 5.3 | — | 2026-06-09 | |
| CVE-2026-47349 | TYPO3 CMS - Broken Access Control in Recycler | < 10.4.57 ≥ 11.0.0 < 11.5.51 ≥ 12.0.0 < 12.4.46 | 5.3 | — | 2026-06-09 | |
| CVE-2026-47348 | TYPO3 CMS - Cross-Site Scripting in Indexed Search | ≥ 13.0.0 < 13.4.31 ≥ 14.0.0 < 14.3.3 | 5.1 | — | 2026-06-09 | |
| CVE-2026-47347 | TYPO3 CMS - Open Redirect in Core Utilities | < 10.4.57 ≥ 11.0.0 < 11.5.51 ≥ 12.0.0 < 12.4.46 | 5.3 | — | 2026-06-09 | |
| CVE-2026-47346 | TYPO3 CMS - Broken Access Control in Form Framework | < 10.4.57 ≥ 11.0.0 < 11.5.51 ≥ 12.0.0 < 12.4.46 | 7.6 | — | 2026-06-09 | |
| CVE-2026-47343 | TYPO3 CMS - Destructive Actions on File Mount Folders | < 10.4.57 ≥ 11.0.0 < 11.5.51 ≥ 12.0.0 < 12.4.46 | 7.2 | — | 2026-06-09 | |
| CVE-2026-11607 | TYPO3 CMS - Broken Access Control in Form Framework | < 10.4.57 ≥ 11.0.0 < 11.5.51 ≥ 12.0.0 < 12.4.46 | 7.6 | — | 2026-06-09 | |
| CVE-2026-6553 | TYPO3 CMS Stores Cleartext Password in User Settings Module | ≥ 14.2.0 < 14.3.0 | 7.3 | — | 2026-04-21 | |
| CVE-2026-0859 | TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool | ≥ 10.0.0 < 10.4.55 ≥ 11.0.0 < 11.5.49 ≥ 12.0.0 < 12.4.41 | 5.2 | — | 2026-01-13 | |
| CVE-2025-59022 | TYPO3 CMS Allows Broken Access Control in Recycler Module | ≥ 10.0.0 < 10.4.55 ≥ 11.0.0 < 11.5.49 ≥ 12.0.0 < 12.4.41 | 7.1 | — | 2026-01-13 | |
| CVE-2025-59021 | TYPO3 CMS Allows Broken Access Control in Redirects Module | ≥ 10.0.0 < 10.4.55 ≥ 11.0.0 < 11.5.49 ≥ 12.0.0 < 12.4.41 | 5.3 | — | 2026-01-13 | |
| CVE-2025-59020 | TYPO3 CMS Allows Broken Access Control in Edit Document Controller | ≥ 10.0.0 < 10.4.55 ≥ 11.0.0 < 11.5.49 ≥ 12.0.0 < 12.4.41 | 5.3 | — | 2026-01-13 | |
| CVE-2025-59019 | Information Disclosure via CSV Download | ≥ 12.0.0 < 12.4.37 ≥ 13.0.0 < 13.4.18 ≥ 11.0.0 < 11.5.48 | 5.3 | — | 2025-09-09 | |
| CVE-2025-59018 | Information Disclosure in Workspaces Module | ≥ 9.0.0 < 9.5.55 ≥ 10.0.0 < 10.4.54 ≥ 11.0.0 < 11.5.48 | 7.1 | — | 2025-09-09 | |
| CVE-2025-59017 | Broken Access Control in Backend AJAX Routes | ≥ 9.0.0 < 9.5.55 ≥ 10.0.0 < 10.4.54 ≥ 11.0.0 < 11.5.48 | 5.3 | — | 2025-09-09 | |
| CVE-2025-59016 | Information Disclosure via File Abstraction Layer | ≥ 9.0.0 < 9.5.55 ≥ 10.0.0 < 10.4.54 ≥ 11.0.0 < 11.5.48 | 5.3 | — | 2025-09-09 | |
| CVE-2025-59015 | Insufficient Entropy in Password Generation | ≥ 12.0.0 < 12.4.37 ≥ 13.0.0 < 13.4.18 | 6.3 | — | 2025-09-09 | |
| CVE-2025-59014 | Denial of Service in TYPO3 Bookmark Toolbar | ≥ 11.0.0 < 11.5.48 ≥ 12.0.0 < 12.4.37 ≥ 13.0.0 < 13.4.18 | 5.1 | — | 2025-09-09 | |
| CVE-2025-59013 | Open Redirect in TYPO3 CMS | ≥ 9.0.0 < 9.5.55 ≥ 10.0.0 < 10.4.54 ≥ 11.0.0 < 11.5.48 | 5.3 | — | 2025-09-09 | |
| CVE-2025-47941 | TYPO3 Has Broken Authentication in Backend MFA | * | 7.2 | — | 2025-05-20 | |
| CVE-2025-47940 | TYPO3 CMS Vulnerable to Privilege Escalation to System Maintainer | * | 7.2 | — | 2025-05-20 | |
| CVE-2025-47939 | TYPO3 CMS Vulnerable to Unrestricted File Upload in File Abstraction Layer | * | 5.4 | — | 2025-05-20 | |
| CVE-2025-47938 | TYPO3 Vulnerable to Unverified Password Change for Backend Users | * | 3.8 | — | 2025-05-20 | |
| CVE-2025-47937 | TYPO3 Vulnerable to Information Disclosure via DBAL Restriction Handling | * | 3.7 | — | 2025-05-20 | |
| CVE-2025-47936 | TYPO3 Vulnerable to Server Side Request Forgery via Webhooks | * | 3.3 | — | 2025-05-20 | |
| CVE-2024-55892 | Potential Open Redirect via Parsing Differences in TYPO3 | * | 4.8 | — | 2025-01-15 | |
| CVE-2024-55893 | TYPO3 Cross-Site Request Forgery in Log Module | * | 4.3 | — | 2025-01-15 | |
| CVE-2024-55894 | TYPO3 Cross-Site Request Forgery in Backend User Module | * | 4.3 | — | 2025-01-15 | |
| CVE-2024-55920 | Cross-Site Request Forgery in Dashboard Module in TYPO3 | * | 4.3 | — | 2025-01-15 | |
| CVE-2024-55921 | Cross-Site Request Forgery in Extension Manager Module in TYPO3 | * | 7.5 | — | 2025-01-15 | |
| CVE-2024-55922 | Cross-Site Request Forgery in Form Framework Module in TYPO3 | * | 5.4 | — | 2025-01-15 | |
| CVE-2024-55923 | Cross-Site Request Forgery in Indexed Search Module in TYPO3 | * | 4.3 | — | 2025-01-15 | |
| CVE-2024-55924 | Cross-Site Request Forgery in Scheduler Module in TYPO3 | * | 8.0 | — | 2025-01-15 | |
| CVE-2024-55945 | Cross-Site Request Forgery in DB Check Module in TYPO3 | * | 4.3 | — | 2025-01-15 | |
| CVE-2024-55891 | Information Disclosure via Exception Handling/Logger in TYPO3 | * | 3.1 | — | 2025-01-15 | |
| CVE-2024-34537 | TYPO3 before 13.3.1 allows denial of service (interface error) in the Bookmark Toolbar (ext:backend), exploita... | * | 4.9 | — | 2024-10-28 | |
| CVE-2024-47780 | Information Disclosure in TYPO3 Page Tree | * | 3.1 | — | 2024-10-09 | |
| CVE-2024-34358 | TYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageController | * | 5.3 | — | 2024-05-14 | |
| CVE-2024-34357 | TYPO3 vulnerable to Cross-Site Scripting in ShowImageController | * | 5.4 | — | 2024-05-14 | |
| CVE-2024-34356 | TYPO3 vulnerable to Cross-Site Scripting in the Form Manager Module | * | 5.4 | — | 2024-05-14 | |
| CVE-2024-34355 | TYPO3 vulnerable to an HTML Injection in the History Module | * | 3.5 | — | 2024-05-14 | |
| CVE-2024-22188 | TYPO3 before 13.0.1 allows an authenticated admin user (with system maintainer privileges) to execute arbitrar... | * | 7.2 | — | 2024-03-05 | |
| CVE-2024-25118 | Information Disclosure of Hashed Passwords in TYPO3 Backend Forms | * | 4.3 | — | 2024-02-14 | |
| CVE-2024-25119 | Information Disclosure of Encryption Key in TYPO3 Install Tool | * | 4.9 | — | 2024-02-14 | |
| CVE-2024-25120 | Improper Access Control of Resources Referenced by t3:// URI Scheme in TYPO3 | * | 4.3 | — | 2024-02-14 | |
| CVE-2024-25121 | Improper Access Control Persisting File Abstraction Layer Entities via Data Handler in TYPO3 | * | 7.1 | — | 2024-02-14 | |
| CVE-2023-47126 | Information Disclosure in Install Tool in typo3/cms-install | * | 3.7 | — | 2023-11-15 | |
| CVE-2023-47127 | Weak Authentication in Session Handling in typo3/cms-core | * | 4.2 | — | 2023-11-15 | |
| CVE-2023-38499 | typo3/cms-core Information Disclosure due to Out-of-scope Site Resolution | * | 3.7 | — | 2023-07-26 |
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
Data: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (see EPSS at https://www.first.org/epss), endoflife.date. Software list: awesome-selfhosted (CC BY-SA 3.0).