Security releases
Researcher credits in vendor advisories
Vendors name researchers in their own advisories. Find your line and claim it. It counts on your profile right away and gets a BugRater ID you can quote.
Vendor
-
Typo3 CVE-2026-120333
The actions linked in the emails of the extension (e.g. to confirm a registration or the deletion of an account) do not reject requests with a missing or invali
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Typo3 CVE-2026-120332
The HTML content of mails and tracked URLs are rendered unescaped in the backend module. Backend users with access to the mail module can inject arbitrary HTML
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Typo3 CVE-2026-120331
Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend users with access to t
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Typo3 CVE-2026-120330
Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or recipient group. Backen
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Typo3 CVE-2026-120329
Saving the configuration of the mail backend module writes submitted settings to the page TSconfig without restricting them to the configuration options of the
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Typo3 CVE-2026-120328
The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can retrieve personal d
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Typo3 CVE-2026-120327
The click tracking middleware accepts an arbitrary target URL and redirects to it. Attackers can misuse links to the website to redirect users to external sites
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit
-
Typo3 CVE-2026-113468
The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visitor can overwrite the
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Typo3 CVE-2026-113459
In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI servic
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Typo3 CVE-2026-113442
Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an emai
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Typo3 CVE-2026-112240
The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Typo3 CVE-2026-112239
The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissi
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Typo3 CVE-2026-112238
The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Typo3 CVE-2026-112237
The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does not apply the authori
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Typo3 CVE-2026-112071
The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor c
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Typo3 CVE-2026-112070
The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrie
0 CVEs and 0 credit lines.
-
Typo3 CVE-2026-112069
The extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were served directly by t
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Typo3 CVE-2026-112068
The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dash
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Typo3 CVE-2026-112067
The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can request a CAPTCHA image can read the answer f
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Typo3 CVE-2026-112066
The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could impo
0 CVEs and 0 credit lines.
-
Typo3 CVE-2026-112065
The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authen
0 CVEs and 0 credit lines.
-
Typo3 CVE-2026-112064
The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without val
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit
-
Typo3 typo3-2026-10
Typo3 Security Releases - October 2026
2 CVEs and 2 credit lines. None claimed yet.
0 of 2 credit lines claimed Claim credit