prod
Typo3 10.4
76 vulnerabilities has been found
1 abandonned packages has been found
Last analyse : 2 hours ago
76
Vulnerabilities
21 affected packages
- Critical 0
- High 9
- Medium 38
- Low 7
- Unrated 0
-
Composer
76
76
Composer
Vulnerabilities
- Critical 0
- High 9
- Medium 38
- Low 7
- Unrated 0
1
enshrined/svg-sanitize
0.15.4
-
Medium CVE-2025-55166 Reported 8/12/25svg-sanitizer Bypasses Attribute Sanitization
- Affected versions
<0.22.0- Patched versions
0.22.0
9
guzzlehttp/guzzle
6.5.8
-
High CVE-2026-69246 Reported 8/3/26Guzzle: Noncanonical host can bypass host-based checks
- Affected versions
>=8.0.0,<8.0.1|<7.15.2- Patched versions
7.15.28.0.1
-
Medium CVE-2026-55767 Reported 6/18/26Dot-only cookie domains match all hosts
- Affected versions
<7.12.1- Patched versions
7.12.1
https://github.com/guzzle/guzzle/security/advisories/GHSA-cwxw-98qj-8qjx
-
Medium Reported 7/20/26Guzzle: Unbounded response cookies risk denial of service
- Affected versions
<7.15.1- Patched versions
7.15.1
-
Medium CVE-2026-59883 Reported 7/20/26Guzzle: Cookie Disclosure and Injection via IP-Address Domains
- Affected versions
<7.12.3- Patched versions
7.12.3
-
Medium CVE-2026-69245 Reported 8/3/26Guzzle: Noncanonical cookie domain keeps subdomain scope
- Affected versions
>=8.0.0,<8.0.1|<7.15.2- Patched versions
7.15.28.0.1
-
Medium Reported 7/20/26Guzzle: URI fragments disclosed in redirect Referer headers
- Affected versions
<7.15.1- Patched versions
7.15.1
-
Medium CVE-2026-55568 Reported 6/18/26Silent HTTPS proxy downgrade to cleartext
- Affected versions
<7.12.1- Patched versions
7.12.1
https://github.com/guzzle/guzzle/security/advisories/GHSA-wpwq-4j6v-78m3
-
Medium Reported 7/20/26Guzzle: Proxy-Authorization headers can be sent to origin servers
- Affected versions
<7.14.2- Patched versions
7.14.2
-
Medium Reported 7/20/26Guzzle: Host-only cookie scope is not preserved
- Affected versions
<7.15.1- Patched versions
7.15.1
4
guzzlehttp/psr7
1.9.1
-
Medium CVE-2026-55766 Reported 6/18/26CRLF injection in HTTP start-line serialization
- Affected versions
<2.12.1- Patched versions
2.12.1
https://github.com/guzzle/psr7/security/advisories/GHSA-vm85-hxw5-5432
-
Medium CVE-2026-49214 Reported 6/11/26guzzlehttp/psr7 has CRLF Injection via URI Host Component
- Affected versions
<2.10.2- Patched versions
2.10.2
-
Medium CVE-2026-48998 Reported 6/11/26guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation
- Affected versions
<2.10.2- Patched versions
2.10.2
-
Medium CVE-2026-59882 Reported 7/21/26guzzlehttp/psr7: Host Confusion via Weak URI Host Validation
- Affected versions
<2.12.3- Patched versions
2.12.3
1
symfony/cache
v4.4.48
-
Unrated CVE-2026-45073 Reported 5/20/26CVE-2026-45073: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
2
symfony/http-foundation
v4.4.49
-
High CVE-2025-64500 Reported 11/12/25CVE-2025-64500: Incorrect parsing of PATH_INFO can lead to limited authorization bypass
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.50|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.29|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.3.7- Patched versions
5.4.506.4.297.3.75.4.506.4.297.3.7
-
Low CVE-2024-50345 Reported 11/5/24CVE-2024-50345: Open redirect via browser-sanitized URLs
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.46|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.14|>=7.0.0,<7.1.0|>=7.1.0,<7.1.7- Patched versions
5.4.466.4.147.1.75.4.466.4.147.1.7
1
symfony/mailer
v4.4.49
-
Unrated CVE-2026-45068 Reported 5/20/26CVE-2026-45068: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
2
symfony/mime
v4.4.47
-
Unrated CVE-2026-45067 Reported 5/20/26CVE-2026-45067: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
-
Unrated CVE-2026-45070 Reported 5/20/26CVE-2026-45070: Email Header Injection via Non-Token Characters in Mime Parameter Names
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
1
symfony/polyfill-intl-idn
v1.29.0
-
Unrated CVE-2026-46644 Reported 5/26/26CVE-2026-46644: symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence
- Affected versions
>=1.17.1,<1.38.1
2
symfony/process
v4.4.44
-
High CVE-2024-51736 Reported 11/5/24CVE-2024-51736: Command execution hijack on Windows with Process class
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.46|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.14|>=7.0.0,<7.1.0|>=7.1.0,<7.1.7- Patched versions
5.4.466.4.147.1.75.4.466.4.147.1.7
-
Medium CVE-2026-24739 Reported 1/28/26Symfony's incorrect argument escaping under MSYS2/Git Bash can lead to destructive file operations on Windows
- Affected versions
>=8.0,<8.0.5|>=7.4,<7.4.5|>=7.3,<7.3.11|>=6.4,<6.4.33|<5.4.51- Patched versions
5.4.516.4.337.3.117.4.58.0.55.4.516.4.337.3.117.4.58.0.5
2
symfony/routing
v4.4.44
-
Unrated CVE-2026-48784 Reported 5/26/26CVE-2026-48784: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.53|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.41|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.13|>=8.0.0,<8.0.13
-
Unrated CVE-2026-45065 Reported 5/20/26CVE-2026-45065: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
3
symfony/yaml
v4.4.45
-
Unrated CVE-2026-45133 Reported 5/20/26CVE-2026-45133: YAML Parser Stack Exhaustion via Unbounded Recursion in Nested Blocks, Sequences, and Mappings
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
-
Unrated CVE-2026-45305 Reported 5/20/26CVE-2026-45305: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
-
Unrated CVE-2026-45304 Reported 5/20/26CVE-2026-45304: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")
- Affected versions
>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
7
typo3/cms-backend
v10.4.37
-
Medium CVE-2025-59017 Reported 9/9/25TYPO3 backend modules have Broken Access Control
- Affected versions
>=13.0.0,<13.4.18|>=12.0.0,<12.4.37|>=11.0.0,<11.5.48|>=10.0.0,<10.4.54|>=9.0.0,<9.5.55- Patched versions
12.4.3712.4.3712.4.3712.4.3713.4.1812.4.3712.4.3712.4.3712.4.3713.4.1812.4.3712.4.3712.4.3713.4.1813.4.1812.4.3712.4.3712.4.3712.4.3712.4.3712.4.3712.4.3712.4.3713.4.18
-
Medium CVE-2026-47351 Reported 6/12/26TYPO3 CMS: Broken Access Control in Media Module
- Affected versions
>=14.0.0,<14.3.3|>=13.0.0,<13.4.31|>=12.0.0,<12.4.46|>=11.0.0,<11.5.51|<10.4.57- Patched versions
10.4.5711.5.5112.4.4613.4.3114.3.310.4.5711.5.5112.4.4613.4.3114.3.3
-
Medium CVE-2025-59020 Reported 1/13/26TYPO3 CMS Allows Broken Access Control in Edit Document Controller
- Affected versions
>=10.0.0,<=10.4.54|>=11.0.0,<=11.5.48|>=12.0.0,<=12.4.40|>=13.0.0,<=13.4.22|>=14.0.0,<=14.0.1- Patched versions
14.0.213.4.2312.4.4111.5.4910.4.55
-
Medium CVE-2026-47352 Reported 6/12/26TYPO3 CMS has Broken Access Control in Backend API
- Affected versions
>=14.0.0,<14.3.3|>=13.0.0,<13.4.31|>=12.0.0,<12.4.46|>=11.0.0,<11.5.51|<10.4.57- Patched versions
10.4.5711.5.5112.4.4613.4.3114.3.310.4.5711.5.5112.4.4613.4.3114.3.3
-
Low CVE-2024-47780 Reported 10/8/24Information Disclosure in TYPO3 Page Tree
- Affected versions
<11.5.40|>=12.0.0,<12.4.21|>=13.0.0,<13.3.1- Patched versions
13.3.112.4.2111.5.40
-
Unrated CVE-2026-77132 Reported 9/8/26TYPO3-CORE-SA-2026-022: Information Disclosure via Backend Localization Wizard
- Affected versions
>=10.0.0,<10.4.60|>=11.0.0,<11.5.54|>=12.0.0,<12.4.49|>=13.0.0,<13.4.35|>=14.0.0,<14.3.7
https://news.typo3.com/security/advisory/typo3-core-sa-2026-022
-
Low CVE-2024-34537 Reported 10/8/24Denial of Service in TYPO3 Bookmark Toolbar
- Affected versions
>=10.0.0,<=10.4.45|>=11.0.0,<=11.5.39|>=12.0.0,<12.4.20|=13.0.0- Patched versions
13.3.112.4.2111.5.4010.4.46
1
typo3/cms-belog
v10.4.37
-
Medium CVE-2024-55893 Reported 1/14/25TYPO3 Cross-Site Request Forgery in Log Module
- Affected versions
>=13.0.0,<=13.4.2|>=12.0.0,<=12.4.24|>=11.0.0,<=11.5.41|>=10.0.0,<=10.4.47- Patched versions
10.4.4811.5.4212.4.2513.4.3
2
typo3/cms-beuser
v10.4.37
-
Medium CVE-2025-59017 Reported 9/9/25TYPO3 backend modules have Broken Access Control
- Affected versions
>=9.0.0,<9.5.55|>=10.0.0,<10.4.54|>=11.0.0,<11.5.48|>=12.0.0,<12.4.37|>=13.0.0,<13.4.18- Patched versions
12.4.3712.4.3712.4.3712.4.3713.4.1812.4.3712.4.3712.4.3712.4.3713.4.1812.4.3712.4.3712.4.3713.4.1813.4.1812.4.3712.4.3712.4.3712.4.3712.4.3712.4.3712.4.3712.4.3713.4.18
-
Medium CVE-2024-55894 Reported 1/14/25TYPO3 Cross-Site Request Forgery in Backend User Module
- Affected versions
>=13.0.0,<=13.4.2|>=12.0.0,<=12.4.24|>=11.0.0,<=11.5.41|>=10.0.0,<=10.4.47- Patched versions
10.4.4811.5.4212.4.2513.4.3
28
typo3/cms-core
v10.4.37
-
High CVE-2025-47940 Reported 5/20/25TYPO3 Allows Privilege Escalation to System Maintainer
- Affected versions
>=13.0.0,<=13.4.11|>=12.0.0,<=12.4.30|>=11.0.0,<=11.5.43|>=10.4.0,<=10.4.49- Patched versions
10.4.5011.5.4412.4.3113.4.12
-
High CVE-2024-25121 Reported 2/13/24TYPO3 vulnerable to Improper Access Control Persisting File Abstraction Layer Entities via Data Handler
- Affected versions
=13.0.0|>=12.0.0,<=12.4.10|>=11.0.0,<=11.5.34|>=10.0.0,<=10.4.42|>=9.0.0,<=9.5.45|>=8.0.0,<=8.7.56- Patched versions
8.7.579.5.4610.4.4311.5.3512.4.1113.0.1
-
High CVE-2024-22188 Reported 2/13/24TYPO3 Install Tool vulnerable to Code Execution
- Affected versions
=13.0.0|>=12.0.0,<=12.4.10|>=11.0.0,<=11.5.34|>=10.0.0,<=10.4.42|>=9.0.0,<=9.5.45|>=8.0.0,<=8.7.56- Patched versions
8.7.579.5.4610.4.4311.5.3512.4.1113.0.1
-
Medium CVE-2024-55892 Reported 1/14/25TYPO3 Potential Open Redirect via Parsing Differences
- Affected versions
>=13.0.0,<=13.4.2|>=12.0.0,<=12.4.24|>=11.0.0,<=11.5.41|>=10.0.0,<=10.4.47|>=9.0.0,<=9.5.48- Patched versions
9.5.4910.4.4811.5.4212.4.2513.4.3
-
Medium CVE-2024-34357 Reported 5/14/24TYPO3 vulnerable to Cross-Site Scripting in the ShowImageController
- Affected versions
>=13.0.0,<=13.1.0|>=12.0.0,<=12.4.14|>=11.0.0,<=11.5.36|>=10.0.0,<=10.4.44|>=9.0.0,<=9.5.47- Patched versions
9.5.4810.4.4511.5.3712.4.1513.1.1
-
Medium CVE-2024-34356 Reported 5/14/24TYPO3 vulnerable to Cross-Site Scripting in the Form Manager Module
- Affected versions
>=13.0.0,<=13.1.0|>=12.0.0,<=12.4.14|>=11.0.0,<=11.5.36|>=10.0.0,<=10.4.44|>=9.0.0,<=9.5.47- Patched versions
9.5.4810.4.4511.5.3712.4.1513.1.1
-
Medium CVE-2024-25119 Reported 2/13/24TYPO3 Install Tool vulnerable to Information Disclosure of Encryption Key
- Affected versions
=13.0.0|>=12.0.0,<=12.4.10|>=11.0.0,<=11.5.34|>=10.0.0,<=10.4.42|>=9.0.0,<=9.5.45|>=8.0.0,<=8.7.56- Patched versions
8.7.579.5.4610.4.4311.5.3512.4.1113.0.1
-
Medium CVE-2024-25120 Reported 2/13/24TYPO3 vulnerable to Improper Access Control of Resources Referenced by t3:// URI Scheme
- Affected versions
=13.0.0|>=12.0.0,<=12.4.10|>=11.0.0,<=11.5.34|>=10.0.0,<=10.4.42|>=9.0.0,<=9.5.45|>=8.0.0,<=8.7.56- Patched versions
8.7.579.5.4610.4.4311.5.3512.4.1113.0.1
-
Medium CVE-2024-25118 Reported 2/13/24TYPO3 Backend Forms vulnerable to Information Disclosure of Hashed Passwords
- Affected versions
=13.0.0|>=12.0.0,<=12.4.10|>=11.0.0,<=11.5.34|>=10.0.0,<=10.4.42|>=9.0.0,<=9.5.45|>=8.0.0,<=8.7.56- Patched versions
8.7.579.5.4610.4.4311.5.3512.4.1113.0.1
-
Medium CVE-2023-47127 Reported 11/14/23TYPO3-CORE-SA-2023-006: Weak Authentication in Session Handling
- Affected versions
>=8.0.0,<8.7.55|>=9.0.0,<9.5.44|>=10.0.0,<10.4.41|>=11.0.0,<11.5.33|>=12.0.0,<12.4.8- Patched versions
8.7.559.5.4410.4.4111.5.3312.4.8
-
Medium CVE-2025-59016 Reported 9/9/25TYPO3 CMS exposes sensitive information in an error message
- Affected versions
>=13.0.0,<13.4.18|>=12.0.0,<12.4.37|>=11.0.0,<11.5.48|>=10.0.0,<10.4.54|>=9.0.0,<9.5.55- Patched versions
12.4.3712.4.3712.4.3712.4.3713.4.18
-
Medium CVE-2025-59013 Reported 9/9/25TYPO3 CMS has an open‑redirect vulnerability
- Affected versions
>=13.0.0,<13.4.18|>=12.0.0,<12.4.37|>=11.0.0,<11.5.48|>=10.0.0,<10.4.54|>=9.0.0,<9.5.55- Patched versions
12.4.3712.4.3712.4.3712.4.3713.4.18
-
Medium CVE-2025-47939 Reported 5/20/25TYPO3 Allows Unrestricted File Upload in File Abstraction Layer
- Affected versions
>=13.0.0,<=13.4.11|>=12.0.0,<=12.4.30|>=11.0.0,<=11.5.43|>=10.0.0,<=10.4.49|>=9.0.0,<=9.5.50- Patched versions
9.5.5110.4.5011.5.4412.4.3113.4.12
-
Medium CVE-2026-0859 Reported 1/13/26TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool
- Affected versions
>=10.0.0,<=10.4.54|>=11.0.0,<=11.5.48|>=12.0.0,<=12.4.40|>=13.0.0,<=13.4.22|>=14.0.0,<=14.0.1- Patched versions
14.0.213.4.2312.4.4111.5.4910.4.55
-
Medium CVE-2024-34358 Reported 5/14/24TYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageController
- Affected versions
>=13.0.0,<=13.1.0|>=12.0.0,<=12.4.14|>=11.0.0,<=11.5.36|>=10.0.0,<=10.4.44|>=9.0.0,<=9.5.47- Patched versions
9.5.4810.4.4511.5.3712.4.1513.1.1
-
Medium CVE-2023-30451 Reported 2/13/24Path Traversal in TYPO3 File Abstraction Layer Storages
- Affected versions
=13.0.0|>=12.0.0,<=12.4.10|>=11.0.0,<=11.5.34|>=10.0.0,<=10.4.42|>=9.0.0,<=9.5.45|>=8.0.0,<=8.7.56
-
Unrated CVE-2026-11607 Reported 6/9/26TYPO3-CORE-SA-2026-019: Broken Access Control in Form Framework
- Affected versions
<10.4.57|>=11.0.0,<11.5.51|>=12.0.0,<12.4.46|>=13.0.0,<13.4.31|>=14.0.0,<14.3.3
-
Unrated CVE-2026-47351 Reported 6/9/26TYPO3-CORE-SA-2026-014: Broken Access Control in Clipboard
- Affected versions
<10.4.57|>=11.0.0,<11.5.51|>=12.0.0,<12.4.46|>=13.0.0,<13.4.31|>=14.0.0,<14.3.3
-
Low CVE-2025-47938 Reported 5/20/25TYPO3 Unverified Password Change for Backend Users
- Affected versions
>=13.0.0,<=13.4.11|>=12.0.0,<=12.4.30|>=11.0.0,<=11.5.43|>=10.0.0,<=10.4.49|>=9.0.0,<=9.5.50- Patched versions
9.5.519.5.5110.4.5011.5.4412.4.3113.4.1210.4.5011.5.4412.4.3113.4.12
-
Unrated CVE-2026-47346 Reported 6/9/26TYPO3-CORE-SA-2026-008: Broken Access Control in Form Framework
- Affected versions
<10.4.57|>=11.0.0,<11.5.51|>=12.0.0,<12.4.46|>=13.0.0,<13.4.31|>=14.0.0,<14.3.3
-
Low CVE-2023-38499 Reported 7/25/23Information Disclosure due to Out-of-scope Site Resolution
- Affected versions
>=12.0.0,<12.4.4|>=11.0.0,<11.5.30|>=10.0.0,<10.4.39|>=9.4.0,<9.5.42- Patched versions
9.5.4210.4.3911.5.3012.4.4
-
Low CVE-2025-47937 Reported 5/20/25TYPO3 Allows Information Disclosure via DBAL Restriction Handling
- Affected versions
>=13.0.0,<=13.4.11|>=12.0.0,<=12.4.30|>=11.0.0,<=11.5.43|>=10.0.0,<=10.4.49|>=9.0.0,<=9.5.50- Patched versions
9.5.5110.4.5011.5.4412.4.3113.4.12
-
Unrated CVE-2026-47349 Reported 6/9/26TYPO3-CORE-SA-2026-011: Broken Access Control in Recycler
- Affected versions
<10.4.57|>=11.0.0,<11.5.51|>=12.0.0,<12.4.46|>=13.0.0,<13.4.31|>=14.0.0,<14.3.3
-
Unrated CVE-2026-47343 Reported 6/9/26TYPO3-CORE-SA-2026-007: Broken Access Control in File Abstraction Layer
- Affected versions
<10.4.57|>=11.0.0,<11.5.51|>=12.0.0,<12.4.46|>=13.0.0,<13.4.31|>=14.0.0,<14.3.3
-
Unrated CVE-2026-49738 Reported 6/9/26TYPO3-CORE-SA-2026-016: Broken Access Control in File Abstraction Layer
- Affected versions
<10.4.57|>=11.0.0,<11.5.51|>=12.0.0,<12.4.46|>=13.0.0,<13.4.31|>=14.0.0,<14.3.3
-
Unrated CVE-2026-47352 Reported 6/9/26TYPO3-CORE-SA-2026-015: Broken Access Control in Backend API
- Affected versions
<10.4.57|>=11.0.0,<11.5.51|>=12.0.0,<12.4.46|>=13.0.0,<13.4.31|>=14.0.0,<14.3.3
-
Unrated CVE-2026-49740 Reported 6/9/26TYPO3-CORE-SA-2026-018: Insecure Deserialization in Core API
- Affected versions
<10.4.57|>=11.0.0,<11.5.51|>=12.0.0,<12.4.46|>=13.0.0,<13.4.31|>=14.0.0,<14.3.3
-
Unrated CVE-2026-47347 Reported 6/9/26TYPO3-CORE-SA-2026-009: Open Redirect in TYPO3 CMS
- Affected versions
<10.4.57|>=11.0.0,<11.5.51|>=12.0.0,<12.4.46|>=13.0.0,<13.4.31|>=14.0.0,<14.3.3
2
typo3/cms-dashboard
v10.4.37
-
Medium CVE-2024-55920 Reported 1/14/25TYPO3 Cross-Site Request Forgery in Dashboard Module
- Affected versions
>=13.0.0,<=13.4.2|>=12.0.0,<=12.4.24|>=11.0.0,<=11.5.41|>=10.0.0,<=10.4.47- Patched versions
10.4.4811.5.4212.4.2513.4.3
-
Medium CVE-2025-59017 Reported 9/9/25TYPO3 backend modules have Broken Access Control
- Affected versions
>=13.0.0,<13.4.18|>=12.0.0,<12.4.37|>=11.0.0,<11.5.48|>=10.0.0,<10.4.54- Patched versions
12.4.3712.4.3712.4.3712.4.3713.4.1812.4.3712.4.3712.4.3712.4.3713.4.1812.4.3712.4.3712.4.3713.4.1813.4.1812.4.3712.4.3712.4.3712.4.3712.4.3712.4.3712.4.3712.4.3713.4.18
1
typo3/cms-extensionmanager
v10.4.37
-
High CVE-2024-55921 Reported 1/14/25TYPO3 Extension Manager Module vulnerable to Cross-Site Request Forgery
- Affected versions
>=13.0.0,<=13.4.2|>=12.0.0,<=12.4.24|>=11.0.0,<=11.5.41|>=10.0.0,<=10.4.47- Patched versions
10.4.4811.5.4212.4.2513.4.3
3
typo3/cms-form
v10.4.37
-
High CVE-2026-11607 Reported 6/12/26TYPO3 CMS has Broken Access Control in its Form Framework
- Affected versions
>=14.0.0,<14.3.3|>=13.0.0,<13.4.31|>=12.0.0,<12.4.46|>=11.0.0,<11.5.51|<10.4.57- Patched versions
10.4.5711.5.5112.4.4613.4.3114.3.310.4.5711.5.5112.4.4613.4.3114.3.3
-
High CVE-2026-47346 Reported 6/12/26TYPO3 CMS has Broken Access Control in its Form Framework
- Affected versions
>=14.0.0,<14.3.3|>=13.0.0,<13.4.31|>=12.0.0,<12.4.46|>=11.0.0,<11.5.51|<10.4.57- Patched versions
10.4.5711.5.5112.4.4613.4.3114.3.310.4.5711.5.5112.4.4613.4.3114.3.3
-
Medium CVE-2024-55922 Reported 1/14/25TYPO3 Form Framework Module vulnerable to Cross-Site Request Forgery
- Affected versions
>=13.0.0,<=13.4.2|>=12.0.0,<=12.4.24|>=11.0.0,<=11.5.41|>=10.0.0,<=10.4.47- Patched versions
10.4.4811.5.4212.4.2513.4.3
1
typo3/cms-rte-ckeditor
v10.4.37
-
Medium Reported 7/25/23Cross-Site Scripting in CKEditor4 WordCount Plugin
- Affected versions
>=11.0.0,<11.5.30|>=10.0.0,<10.4.39|>=9.5.0,<9.5.42- Patched versions
9.5.4210.4.3911.5.30
1
typo3/cms-setup
v10.4.37
-
Low CVE-2025-47938 Reported 5/20/25TYPO3 Unverified Password Change for Backend Users
- Affected versions
>=13.0.0,<=13.4.11|>=12.0.0,<=12.4.30|>=11.0.0,<=11.5.43|>=10.0.0,<=10.4.49|>=9.0.0,<=9.5.50- Patched versions
9.5.519.5.5110.4.5011.5.4412.4.3113.4.1210.4.5011.5.4412.4.3113.4.12
2
typo3/html-sanitizer
v2.1.4
-
Unrated CVE-2026-47344 Reported 6/8/26TYPO3-CORE-SA-2026-006: TYPO3 HTML Sanitizer allows Cross-Site Scripting
- Affected versions
<2.3.2
-
Unrated CVE-2026-47345 Reported 6/8/26TYPO3-CORE-SA-2026-006: TYPO3 HTML Sanitizer allows Cross-Site Scripting
- Affected versions
<2.3.2
1
Abandonned packages
to replace or keep an eye on
Current vulnerabilities
76
Last change
+1
Sep 9, 2026
Abandoned packages
1
Analyses with changes
32
Vulnerabilities by severity
Changes between analyses
Latest changes
-
Sep 9, 2026, 3:03 AM+1 new76 total
-
Aug 4, 2026, 3:03 AM+2 new75 total
-
Jul 22, 2026, 3:03 AM+1 new73 total
-
Jul 21, 2026, 3:03 AM+5 new72 total
-
Jun 20, 2026, 3:02 AM+3 new67 total
-
Jun 13, 2026, 3:03 AM+6 new64 total
-
Jun 12, 2026, 3:03 AM+11 new58 total
-
May 28, 2026, 3:03 AM+1 new47 total
-
May 27, 2026, 3:03 AM+1 new46 total
-
May 21, 2026, 3:03 AM+8 new45 total
-
May 1, 2026, 3:03 AM+37 new +1 abandoned37 total
-
Apr 30, 2026, 3:02 AM−37 closed −1 abandoned0 total
-
Jan 29, 2026, 2:04 AM+1 new37 total
-
Jan 14, 2026, 2:04 AM+2 new36 total
-
Nov 13, 2025, 2:04 AM+1 new34 total
-
Sep 10, 2025, 3:06 AM+5 new33 total
-
Aug 13, 2025, 3:04 AM+1 new28 total
-
Jun 23, 2025, 4:25 PM−107 closed27 total
-
Jun 19, 2025, 3:01 AM+1 new134 total
-
May 21, 2025, 3:01 AM+5 new133 total
-
Feb 28, 2025, 2:02 AM+128 new +1 abandoned128 total
-
Feb 21, 2025, 3:37 AM−128 closed −1 abandoned0 total
-
Jan 15, 2025, 2:02 AM+6 new128 total
-
Nov 26, 2024, 2:02 AM+16 new +1 abandoned122 total
-
Nov 25, 2024, 2:02 AM−16 closed −1 abandoned106 total
-
Nov 21, 2024, 2:02 AM+1 new122 total
-
Nov 9, 2024, 2:02 AM+105 new121 total
-
Nov 7, 2024, 2:27 AM+2 new16 total
-
Oct 9, 2024, 3:27 AM+2 new14 total
-
Jul 24, 2024, 3:29 AM−101 closed12 total
-
Jul 12, 2024, 8:53 AM+101 new113 total
-
May 18, 2024, 3:01 AM+3 new12 total
Badges
[](https://audit.security.code-rhapsodie.fr/en/project/018f871a-8eac-73fe-8c76-a61063f86748)
[](https://audit.security.code-rhapsodie.fr/en/project/018f871a-8eac-73fe-8c76-a61063f86748)
[](https://audit.security.code-rhapsodie.fr/en/project/018f871a-8eac-73fe-8c76-a61063f86748)
[](https://audit.security.code-rhapsodie.fr/en/project/018f871a-8eac-73fe-8c76-a61063f86748)