Security advisories

Every advisory from the official TYPO3 security feed, newest first. The severity comes from the machine-readable advisory databases; where it is missing there, it stays unknown here.

SecurityHigh
TYPO3-CORE-SA-2026-019: Broken Access Control in Form Framework
It has been discovered that TYPO3 CMS is susceptible to broken access control.
TYPO3 Security Advisories 09.06.2026 TYPO3-CORE-SA-2026-019
SecurityMedium
TYPO3-CORE-SA-2026-018: Insecure Deserialization in Core API
It has been discovered that TYPO3 CMS is susceptible to broken access control.
TYPO3 Security Advisories 09.06.2026 TYPO3-CORE-SA-2026-018
SecurityHigh
TYPO3-CORE-SA-2026-017: Privilege Escalation & SQL Injection in Form Framework
It has been discovered that TYPO3 CMS is susceptible to broken access control.
TYPO3 Security Advisories 09.06.2026 TYPO3-CORE-SA-2026-017
SecurityLow
TYPO3-CORE-SA-2026-016: Broken Access Control in File Abstraction Layer
It has been discovered that TYPO3 CMS is susceptible to broken access control.
TYPO3 Security Advisories 09.06.2026 TYPO3-CORE-SA-2026-016
SecurityMedium
TYPO3-CORE-SA-2026-015: Broken Access Control in Backend API
It has been discovered that TYPO3 CMS is susceptible to broken access control.
TYPO3 Security Advisories 09.06.2026 TYPO3-CORE-SA-2026-015
SecurityMedium
TYPO3-CORE-SA-2026-014: Broken Access Control in Clipboard
It has been discovered that TYPO3 CMS is susceptible to broken access control.
TYPO3 Security Advisories 09.06.2026 TYPO3-CORE-SA-2026-014
SecurityHigh
TYPO3-CORE-SA-2026-013: Broken Access Control in Media Module
It has been discovered that TYPO3 CMS is susceptible to broken access control.
TYPO3 Security Advisories 09.06.2026 TYPO3-CORE-SA-2026-013
SecurityMedium
TYPO3-CORE-SA-2026-012: Broken Access Control in DataHandler
It has been discovered that TYPO3 CMS is susceptible to broken access control.
TYPO3 Security Advisories 09.06.2026 TYPO3-CORE-SA-2026-012
SecurityMedium
TYPO3-CORE-SA-2026-011: Broken Access Control in Recycler
It has been discovered that TYPO3 CMS is susceptible to broken access control.
TYPO3 Security Advisories 09.06.2026 TYPO3-CORE-SA-2026-011
SecurityMedium
TYPO3-CORE-SA-2026-010: Cross-Site Scripting in Indexed Search
It has been discovered that TYPO3 CMS is vulnerable to cross-site scripting.
TYPO3 Security Advisories 09.06.2026 TYPO3-CORE-SA-2026-010
SecurityMedium
TYPO3-CORE-SA-2026-009: Open Redirect in TYPO3 CMS
It has been discovered that TYPO3 CMS is susceptible to open redirect.
TYPO3 Security Advisories 09.06.2026 TYPO3-CORE-SA-2026-009
SecurityHigh
TYPO3-CORE-SA-2026-008: Broken Access Control in Form Framework
It has been discovered that TYPO3 CMS is susceptible to broken access control.
TYPO3 Security Advisories 09.06.2026 TYPO3-CORE-SA-2026-008
SecurityHigh
TYPO3-CORE-SA-2026-007: Broken Access Control in File Abstraction Layer
It has been discovered that TYPO3 CMS is susceptible to broken access control.
TYPO3 Security Advisories 09.06.2026 TYPO3-CORE-SA-2026-007
SecurityHigh
TYPO3-EXT-SA-2026-010: SQL Injection in extension "News system" (news)
It has been discovered that the extension "News system" (news) is vulnerable to SQL Injection.
TYPO3 Security Advisories 19.05.2026 TYPO3-EXT-SA-2026-010
SecurityMedium
TYPO3-EXT-SA-2026-009: Broken Access Control in extension "Frontend User Registration" (sf_register)
It has been discovered that the extension "Frontend User Registration" (sf_register) is vulnerable to Broken Access Control.
TYPO3 Security Advisories 19.05.2026 TYPO3-EXT-SA-2026-009