https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T07:08:03.268172+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2024-avi-0394 certfr-2024-avi-0394 — De multiples vulnérabilités ont été découvertes dans Typo3. Elles permettent à un attaquant de provoquer un déni de ser… 2026-10-10T07:08:03.286987+00:00 certfr-2024-avi-0394 https://cve.radiocsirt.org/vuln/euvd-2026-5481 EUVD-2026-5481 2026-10-10T07:08:03.287049+00:00 EUVD-2026-5481 https://cve.radiocsirt.org/vuln/fkie_cve-2024-34357 fkie_cve-2024-34357 2026-10-10T07:08:03.287073+00:00

TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, failing to properly encode user-controlled values in file entities, the `ShowImageController` (`_eID tx_cms_showpic_`) is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to file entities. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 fix the problem described.

 https://cve.radiocsirt.org/vuln/ghsa-hw6c-6gwq-3m3m GHSA-hw6c-6gwq-3m3m — TYPO3 vulnerable to Cross-Site Scripting in the ShowImageController 2026-10-10T07:08:03.287127+00:00

Affected: Packagist: typo3/cms-core

### Problem Failing to properly encode user-controlled values in file entities, the `ShowImageController` (_eID tx_cms_showpic_) is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to file entities.

### Solution Update to TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 that fix the problem described.

### Credits Thanks to TYPO3 security team member Torben Hansen who reported this issue and to TYPO3 core & security team member Oliver Hader who fixed the issue.

### References * [TYPO3-CORE-SA-2024-009](https://typo3.org/security/advisory/typo3-core-sa-2024-009)

 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1112 WID-SEC-W-2024-1112 — TYPO3 Core: Mehrere Schwachstellen 2026-10-10T07:08:03.287194+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in TYPO3 Core ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen oder einen Denial-of-Service-Zustand zu verursachen.