https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T23:42:09.600297+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2022-17984 cnvd-2022-17984 2026-10-15T23:42:09.604078+00:00 cnvd-2022-17984 https://cve.radiocsirt.org/vuln/euvd-2026-28140 EUVD-2026-28140 2026-10-15T23:42:09.604127+00:00 EUVD-2026-28140 https://cve.radiocsirt.org/vuln/fkie_cve-2021-32767 fkie_cve-2021-32767 2026-10-15T23:42:09.604150+00:00

TYPO3 is an open source PHP based web content management system. In versions 9.0.0 through 9.5.27, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0, user credentials may been logged as plain-text. This occurs when explicitly using log level debug, which is not the default configuration. TYPO3 versions 9.5.28, 10.4.18, 11.3.1 contain a patch for this vulnerability.

 https://cve.radiocsirt.org/vuln/ghsa-34fr-fhqr-7235 GHSA-34fr-fhqr-7235 — Information Disclosure in User Authentication 2026-10-15T23:42:09.604201+00:00

Affected: Packagist: typo3/cms-core, Packagist: typo3/cms

> ### Meta > * CVSS: `AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C` (4.9)

### Problem It has been discovered that user credentials have been logged as plaintext when explicitly using log level debug, which is not the _default_ configuration.

### Solution Update to TYPO3 versions 7.6.52 ELTS, 8.7.41 ELTS, 9.5.28, 10.4.18, 11.3.1 that fix the problem described.

### Credits Thanks to Ingo Schmitt who reported this issue, and to TYPO3 core & security team member Benni Mack who fixed the issue.

### References * [TYPO3-CORE-SA-2021-012](https://typo3.org/security/advisory/typo3-core-sa-2021-012)

 https://cve.radiocsirt.org/vuln/gsd-2021-32767 gsd-2021-32767 2026-10-15T23:42:09.604262+00:00 gsd-2021-32767