typo3 has 46 CVEs on record. Disclosure cadence is accelerating: 31 in the last 90 days against 15 in the 90 before. The busiest recent month was October 2026 with 16. The median CVSS is 6.3 (medium). None have a confirmed exploitation report. The dominant weakness classes are CWE-862 (18) and CWE-863 (5). Most affected products: typo3/cms-core (13), apache-solr-for-typo3/solr (5), femanager (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.3
- Publish → KEV
- —
- Last 90 days
- 31 prev 15
Weakness classes
Products
- typo3/cms-core 13
- apache-solr-for-typo3/solr 5
- femanager 3
- sgalinski/sg-cookie-optin 3
- codingms/fluid-form 2
- codingms/shop 2
Worst active — by depth score
CVE-2026-113468Medium· 6.9Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)50CVE-2026-112071Medium· 6.9Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)50CVE-2023-50461High· 8.8An issue was discovered in the direct_mail (aka Direct Mail) extension through 9.5.1 for TYPO349CVE-2026-112238High· 8.7SQL Injection in extension "File manager" (ameos_filemanager)48CVE-2026-56096Medium· 6.3The extension passes the user-supplied search query parameter to Apache Solr without restricting advanced Solr query syntax such as wildcards, field selectors and range queries47
typo3 vulnerabilities
CVEs affecting typo3, newest first. Open any entry for full detail, references, and exploit status.
46 CVEsRSS
CVE-2026-77127Medium· 6.0Information Disclosure in extension "Modules" (modules)
The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or edit. An authenticated, low-privileged backend user can supply arbitrary table, field and record parameters, and…
CVE-2026-47344LowTYPO3 HTML Sanitizer allows Cross-site Scripting
TYPO3 HTML Sanitizer allows Cross-site Scripting
CVE-2026-47348MediumTYPO3 CMS has Cross-Site Scripting in Indexed Search
TYPO3 CMS has Cross-Site Scripting in Indexed Search
CVE-2026-47351MediumTYPO3 CMS: Broken Access Control in Media Module
TYPO3 CMS: Broken Access Control in Media Module
CVE-2026-47352MediumTYPO3 CMS has Broken Access Control in Backend API
TYPO3 CMS has Broken Access Control in Backend API
CVE-2026-49738LowTYPO3 CMS has Broken Access Control in its File Abstraction Layer
TYPO3 CMS has Broken Access Control in its File Abstraction Layer
CVE-2026-49740MediumTYPO3 CMS has Insecure Deserialization via Core API
TYPO3 CMS has Insecure Deserialization via Core API
CVE-2026-49742HighTYPO3 CMS has Broken Access Control in its Media Module
TYPO3 CMS has Broken Access Control in its Media Module
CVE-2026-47346HighTYPO3 CMS has Broken Access Control in its Form Framework
TYPO3 CMS has Broken Access Control in its Form Framework
CVE-2026-47350MediumTYPO3 CMS has Broken Access Control in its DataHandler
TYPO3 CMS has Broken Access Control in its DataHandler
CVE-2026-49741HighTYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework
TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework
CVE-2026-47345MediumTYPO3 HTML Sanitizer allows Cross-site Scripting
TYPO3 HTML Sanitizer allows Cross-site Scripting
CVE-2026-47343HighTYPO3 CMS: Destructive Actions on File Mount Folders
TYPO3 CMS: Destructive Actions on File Mount Folders
CVE-2026-47347MediumTYPO3 CMS has an Open Redirect Vulnerability via Core Utilities
TYPO3 CMS has an Open Redirect Vulnerability via Core Utilities
CVE-2026-47349MediumTYPO3 CMS has Broken Access Control in the Recycler Module
TYPO3 CMS has Broken Access Control in the Recycler Module
CVE-2026-11607HighTYPO3 CMS has Broken Access Control in its Form Framework
TYPO3 CMS has Broken Access Control in its Form Framework