TYPO3
Number 94 by total vulnerabilities in the catalog.
Computed from the whole catalog when the site is built.
Combines these spellings from source records: TYPO3, typo3
Total vulnerabilities
202
Critical
4
High
60
Known Exploited
0
Exploit available
0
Network, no login needed
42.6%
Of 190 scored records
- Critical
- High
- Medium
- Low
- None or not scored
Show as table
| Period | Total | Critical | High | Medium | Low | None or not scored |
|---|---|---|---|---|---|---|
| 2026 (incomplete) | 88 | 3 | 34 | 48 | 3 | 0 |
| 2025 | 37 | 1 | 10 | 21 | 5 | 0 |
| 2024 | 14 | 0 | 4 | 8 | 2 | 0 |
| 2023 | 6 | 0 | 1 | 3 | 2 | 0 |
| 2022 | 17 | 0 | 1 | 16 | 0 | 0 |
| 2021 | 15 | 0 | 3 | 12 | 0 | 0 |
| 2020 | 13 | 0 | 7 | 4 | 2 | 0 |
| 2019 | 12 | 0 | 0 | 0 | 0 | 12 |
Top products
| Product | Total | Critical/High |
|---|---|---|
| typo3 | 49 | 11 |
| TYPO3 CMS | 38 | 15 |
| TYPO3.CMS | 16 | 3 |
| TYPO3 | 12 | 0 |
| Extension "Mail" | 6 | 1 |
| Extension "Apache Solr for TYPO3 - Enterprise Search" | 5 | 2 |
| Extension "femanager" | 5 | 3 |
| html-sanitizer | 4 | 0 |
| Extension "Faceted Search" | 3 | 0 |
| Extension "sgalinski Cookie Consent" | 3 | 2 |
Top bug types
| Bug type | Total | Critical/High |
|---|---|---|
| Cross-Site Scripting | 31 | 2 |
| Missing Authorization | 30 | 15 |
| Information Disclosure | 16 | 4 |
| Insecure Direct Object Reference | 13 | 5 |
| Cross-Site Request Forgery | 11 | 5 |
| Insecure Deserialization | 10 | 6 |
| Incorrect Authorization | 9 | 2 |
| Path Traversal | 5 | 2 |
| SQL Injection | 5 | 5 |
| URL Redirection to Untrusted Site ('Open Redirect') | 5 | 0 |
Newest vulnerabilities
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2026-120333 | Broken Access Control in extension "Frontend User Registration" (sf_register) | High | 0.4% | |
| CVE-2026-120332 | Cross-Site Scripting in extension "Mail" (mail) | Medium | 0.3% | |
| CVE-2026-120331 | Server-Side Request Forgery in extension "Mail" (mail) | Medium | 0.3% | |
| CVE-2026-120330 | Broken Access Control in extension "Mail" (mail) | High | 0.4% | |
| CVE-2026-120329 | Broken Access Control in extension "Mail" (mail) | Medium | 0.3% | |
| CVE-2026-120328 | Information Disclosure in extension "Mail" (mail) | Medium | 0.4% | |
| CVE-2026-120327 | Open Redirection in extension "Mail" (mail) | Medium | 0.3% | |
| CVE-2026-113468 | Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop) | Medium | 0.4% | |
| CVE-2026-113459 | Sensitive Data Exposure in extension "TYPO3 AI Integration Extension" (ns_t3ai) | High | 0.4% | |
| CVE-2026-113442 | Cross-Site Scripting in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form) | Medium | 0.5% |