Catalog

Findings

Filter the merged record by severity, source, stack, and weakness type.

SearchSeveritySourceStackWeaknessSort

Known exploited only

High7.1The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize().CVE-2026-8727 · CVE.org · NIST NVD · PHP, TYPO3May 19, 2026
Critical9.2The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input.CVE-2026-46725 · CVE.org · NIST NVD · PHP, TYPO3May 19, 2026
Medium5.9The additional_tables configuration of the page and tt_content indexers accepts arbitrary table and field names.CVE-2026-46723 · CVE.org · NIST NVD · TYPO3May 19, 2026
High7.3Changing backend users' passwords via the user settings module results in storing the cleartext password in the uc and user_settings fields of the be_users database table.CVE-2026-6553 · typo3 · typo3 · CVE.org · NIST NVD · TYPO3Apr 21, 2026
Medium5.2The extension fails to properly define allowed classes used when deserializing transport failure metadata.CVE-2026-1323 · cps-it · mailqueue · CVE.org · NIST NVD · TYPO3Mar 17, 2026