typo3/cms-core vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-11607Hightypo3/cms-core: TYPO3 CMS has Broken Access Control in its Form Framework CVE-2026-47349Mediumtypo3/cms-core: TYPO3 CMS has Broken Access Control in the Recycler Module CVE-2026-47347Mediumtypo3/cms-core: TYPO3 CMS has an Open Redirect Vulnerability via Core Utilities CVE-2026-47343Hightypo3/cms-core: TYPO3 CMS: Destructive Actions on File Mount Folders CVE-2026-49741Hightypo3/cms-core: TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework CVE-2026-47350Mediumtypo3/cms-core: TYPO3 CMS has Broken Access Control in its DataHandler CVE-2026-47346Hightypo3/cms-core: TYPO3 CMS has Broken Access Control in its Form Framework CVE-2026-49742Hightypo3/cms-core: TYPO3 CMS has Broken Access Control in its Media Module CVE-2026-49740Mediumtypo3/cms-core: TYPO3 CMS has Insecure Deserialization via Core API CVE-2026-49738Lowtypo3/cms-core: TYPO3 CMS has Broken Access Control in its File Abstraction Layer CVE-2026-47352Mediumtypo3/cms-core: TYPO3 CMS has Broken Access Control in Backend API CVE-2026-47351Mediumtypo3/cms-core: TYPO3 CMS: Broken Access Control in Media Module CVE-2026-47348Mediumtypo3/cms-core: TYPO3 CMS has Cross-Site Scripting in Indexed Search CVE-2026-0859Mediumtypo3/cms-core: TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool CVE-2025-59016Mediumtypo3/cms-core: TYPO3 CMS exposes sensitive information in an error message CVE-2025-59013Mediumtypo3/cms-core: TYPO3 CMS has an open‑redirect vulnerability CVE-2025-59015Mediumtypo3/cms-core: TYPO3 CMS uses insufficient entropy when generating passwords CVE-2025-47940Hightypo3/cms-core: TYPO3 Allows Privilege Escalation to System Maintainer CVE-2025-47939Mediumtypo3/cms-core: TYPO3 Allows Unrestricted File Upload in File Abstraction Layer CVE-2025-47938Lowtypo3/cms-core: TYPO3 Unverified Password Change for Backend Users CVE-2025-47937Lowtypo3/cms-core: TYPO3 Allows Information Disclosure via DBAL Restriction Handling CVE-2024-55892Mediumtypo3/cms-core: TYPO3 Potential Open Redirect via Parsing Differences GHSA-5H5V-M596-R6RFHightypo3/cms-core: TYPO3 Possible Insecure Deserialization in Extbase Request Handling GHSA-6XWF-7RFM-4GWCMediumtypo3/cms-core: TYPO3 Cross-Site Scripting in Filelist Module GHSA-4PPR-JW47-9QM5Mediumtypo3/cms-core: TYPO3 Cross-Site Scripting in Link Handling

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo