https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T22:51:01.369863+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-160768 EUVD-2026-160768 2026-10-06T22:51:01.372984+00:00 EUVD-2026-160768 https://cve.radiocsirt.org/vuln/fkie_cve-2023-47125 fkie_cve-2023-47125 2026-10-06T22:51:01.373030+00:00

TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. This vulnerability has been addressed in versions 1.5.3 and 2.1.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.

 https://cve.radiocsirt.org/vuln/ghsa-mm79-jhqm-9j54 GHSA-mm79-jhqm-9j54 — Bypassing Cross-Site Scripting Protection in TYPO3 HTML Sanitizer 2026-10-06T22:51:01.373072+00:00

Affected: Packagist: typo3/html-sanitizer

> ### CVSS: `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (4.4)

### Problem DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of [`typo3/html-sanitizer`](https://packagist.org/packages/typo3/html-sanitizer).

### Solution Update to `typo3/html-sanitizer` versions 1.5.3 or 2.1.4 that fix the problem described.

### Credits Thanks to Yaniv Nizry and Niels Dossche who reported this issue, and to TYPO3 core & security team member Oliver Hader who fixed the issue.

### References * [TYPO3-CORE-SA-2023-007](https://typo3.org/security/advisory/typo3-core-sa-2023-007) * [Context & Details at `masterminds/html5`](https://github.com/Masterminds/html5-php/issues/241)

 https://cve.radiocsirt.org/vuln/gsd-2023-47125 gsd-2023-47125 2026-10-06T22:51:01.373110+00:00 gsd-2023-47125 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-2883 WID-SEC-W-2023-2883 — TYPO3 Core: Mehrere Schwachstellen 2026-10-06T22:51:01.373125+00:00

Ein Angreifer kann mehrere Schwachstellen in TYPO3 Core ausnutzen, um Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuführen.