TYPO3 security vulnerabilities
CMS / eCommerce / ERP. Public CVE monitoring for TYPO3. Vendor security advisories are linked on this page.
Built for Operators of this product.
456 public records · 0 security-fix timeline events. 0 published in the last 7 days. 441 store a version range.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 0
- High 1
- Medium 1
- Low 0
2026-08-072 issues2026-11-04
Known exploited
View all known exploited- High7.5mathieu_vidal mv_cooking Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 1.29%Feb 2, 2012
- High7.5webempoweredchurch wec_discussion Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 1.30%Apr 7, 2011
Recently published
Browse catalog- Medium6.3The extension no longer applied its access protection to files in file storages that use a non-default relative base path.Check if you run itEPSS 0.47%Oct 20, 2026
- High7.1The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize().Check if you run itEPSS 0.39%May 19, 2026
- Critical9.2The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input.Check if you run itEPSS 2.63%May 19, 2026
- Medium5.9The additional_tables configuration of the page and tt_content indexers accepts arbitrary table and field names.Check if you run itEPSS 0.32%May 19, 2026
- High7.3Changing backend users' passwords via the user settings module results in storing the cleartext password in the uc and user_settings fields of the be_users database table.Check if you run itEPSS 0.17%Apr 21, 2026
- Medium5.2The extension fails to properly define allowed classes used when deserializing transport failure metadata.Check if you run itEPSS 0.23%Mar 17, 2026
- Medium5.2TYPO3's mail‑file spool deserialization flaw lets local users with write access to the spool directory craft a malicious file that is deserialized during the mailer:spool:send commCheck if you run itEPSS 0.18%Jan 13, 2026
- High7.1Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that partiCheck if you run itEPSS 0.42%Jan 13, 2026
- Medium5.3Backend users with access to the redirects module and write permission on the sys_redirect table were able to read, create, and modify any redirect record without restriction to thCheck if you run itEPSS 0.27%Jan 13, 2026
- Medium5.3By exploiting the defVals parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend.Check if you run itEPSS 0.31%Jan 13, 2026