https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T05:21:45.470090+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2022-avi-1097 certfr-2022-avi-1097 — De multiples vulnérabilités ont été découvertes dans Typo3 cms-core. Elles permettent à un attaquant de provoquer une e… 2026-10-03T05:21:45.541766+00:00 certfr-2022-avi-1097 https://cve.radiocsirt.org/vuln/euvd-2026-232246 EUVD-2026-232246 2026-10-03T05:21:45.541804+00:00 EUVD-2026-232246 https://cve.radiocsirt.org/vuln/fkie_cve-2022-23504 fkie_cve-2022-23504 2026-10-03T05:21:45.541820+00:00

TYPO3 is an open source PHP based web content management system. Versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are subject to Sensitive Information Disclosure. Due to the lack of handling user-submitted YAML placeholder expressions in the site configuration backend module, attackers could expose sensitive internal information, such as system configuration or HTTP request messages of other website visitors. A valid backend user account having administrator privileges is needed to exploit this vulnerability. This issue has been patched in versions 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1.

 https://cve.radiocsirt.org/vuln/ghsa-8w3p-qh3x-6gjr GHSA-8w3p-qh3x-6gjr — TYPO3 CMS vulnerable to Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration 2026-10-03T05:21:45.541852+00:00

Affected: Packagist: typo3/cms-core, Packagist: typo3/cms

> ### CVSS: `CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L/E:F/RL:O/RC:C` (5.3)

### Problem Due to the lack of handling user-submitted [YAML placeholder expressions](https://docs.typo3.org/m/typo3/reference-coreapi/main/en-us/Configuration/Yaml/YamlApi.html#custom-placeholder-processing) in the site configuration backend module, attackers could expose sensitive internal information, such as system configuration or HTTP request messages of other website visitors.

A valid backend user account having administrator privileges is needed to exploit this vulnerability.

### Solution Update to TYPO3 versions 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1 that fix the problem described above.

### Credits Thanks to TYPO3 core & security team member Oliver Hader who reported and fixed the issue.

### References * [TYPO3-CORE-SA-2022-016](https://typo3.org/security/advisory/typo3-core-sa-2022-016)

 https://cve.radiocsirt.org/vuln/gsd-2022-23504 gsd-2022-23504 2026-10-03T05:21:45.541892+00:00 gsd-2022-23504 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-2299 WID-SEC-W-2022-2299 — TYPO3 Core: Mehrere Schwachstellen 2026-10-03T05:21:45.541905+00:00

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in TYPO3 Core ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial of Service Zustand herzustellen.