https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T18:43:37.597059+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-06004 bdu:2025-06004 2026-10-04T18:43:37.658102+00:00 bdu:2025-06004 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0429 certfr-2025-avi-0429 — De multiples vulnérabilités ont été découvertes dans les produits Typo3. Certaines d'entre elles permettent à un attaqu… 2026-10-04T18:43:37.658137+00:00 certfr-2025-avi-0429 https://cve.radiocsirt.org/vuln/euvd-2026-240197 EUVD-2026-240197 2026-10-04T18:43:37.658165+00:00 EUVD-2026-240197 https://cve.radiocsirt.org/vuln/fkie_cve-2025-47937 fkie_cve-2025-47937 2026-10-04T18:43:37.658177+00:00

TYPO3 is an open source, PHP based web content management system. Starting in version 9.0.0 and prior to versions 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, and 13.4.12 LTS, when performing a database query involving multiple tables through the database abstraction layer (DBAL), frontend user permissions are only applied via `FrontendGroupRestriction` to the first table. As a result, data from additional tables included in the same query may be unintentionally exposed to unauthorized users. Users should update to TYPO3 version 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, or 13.4.12 LTS to fix the problem.

 https://cve.radiocsirt.org/vuln/ghsa-x8pv-fgxp-8v3x GHSA-x8pv-fgxp-8v3x — TYPO3 Allows Information Disclosure via DBAL Restriction Handling 2026-10-04T18:43:37.658207+00:00

Affected: Packagist: typo3/cms-core

### Problem When performing a database query involving multiple tables through the database abstraction layer (DBAL), frontend user permissions are only applied via `FrontendGroupRestriction` to the last table. As a result, data from additional tables included in the same query may be unintentionally exposed to unauthorized users.

### Solution Update to TYPO3 versions 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, 13.4.12 LTS that fix the problem described.

### Credits Thanks to Christian Futterlieb for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1106 WID-SEC-W-2025-1106 — TYPO3 Core: Mehrere Schwachstellen 2026-10-04T18:43:37.658238+00:00

Ein Angreifer kann mehrere Schwachstellen in TYPO3 Core ausnutzen, um Dateien zu manipulieren, Informationen auszuspähen, Sicherheitsvorkehrungen zu umgehen, einen Denial-of-Service auszulösen oder seine Privilegien zu erweitern.