https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T17:02:26.329120+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2024-avi-0394 certfr-2024-avi-0394 — De multiples vulnérabilités ont été découvertes dans Typo3. Elles permettent à un attaquant de provoquer un déni de ser… 2026-10-10T17:02:26.332918+00:00 certfr-2024-avi-0394 https://cve.radiocsirt.org/vuln/euvd-2026-5479 EUVD-2026-5479 2026-10-10T17:02:26.332961+00:00 EUVD-2026-5479 https://cve.radiocsirt.org/vuln/fkie_cve-2024-34355 fkie_cve-2024-34355 2026-10-10T17:02:26.332977+00:00

TYPO3 is an enterprise content management system. Starting in version 13.0.0 and prior to version 13.1.1, the history backend module is vulnerable to HTML injection. Although Content-Security-Policy headers effectively prevent JavaScript execution, adversaries can still inject malicious HTML markup. Exploiting this vulnerability requires a valid backend user account. TYPO3 version 13.1.1 fixes the problem described.

 https://cve.radiocsirt.org/vuln/ghsa-xjwx-78x7-q6jc GHSA-xjwx-78x7-q6jc — TYPO3 vulnerable to an HTML Injection in the History Module 2026-10-10T17:02:26.333009+00:00

Affected: Packagist: typo3/cms-core

### Problem The history backend module is vulnerable to HTML injection. Although Content-Security-Policy headers effectively prevent JavaScript execution, adversaries can still inject malicious HTML markup. Exploiting this vulnerability requires a valid backend user account.

### Solution Update to TYPO3 version 13.1.1 that fixes the problem described.

### Credits Thanks to TYPO3 core team member Andreas Kienast who reported this issue and to TYPO3 core & security team Benjamin Franzke who fixed the issue.

### References * [TYPO3-CORE-SA-2024-007](https://typo3.org/security/advisory/typo3-core-sa-2024-007)

 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1112 WID-SEC-W-2024-1112 — TYPO3 Core: Mehrere Schwachstellen 2026-10-10T17:02:26.333040+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in TYPO3 Core ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen oder einen Denial-of-Service-Zustand zu verursachen.