https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T14:10:38.354450+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-0037 certfr-2026-avi-0037 — De multiples vulnérabilités ont été découvertes dans Typo3. Elles permettent à un attaquant de provoquer une exécution… 2026-10-02T14:10:38.403098+00:00 certfr-2026-avi-0037 https://cve.radiocsirt.org/vuln/euvd-2026-265555 EUVD-2026-265555 2026-10-02T14:10:38.403143+00:00 EUVD-2026-265555 https://cve.radiocsirt.org/vuln/fkie_cve-2025-59020 fkie_cve-2025-59020 2026-10-02T14:10:38.403159+00:00

By exploiting the defVals parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability to insert arbitrary data into prohibited exclude fields of a database table for which the user already has write permission for a reduced set of fields. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.

 https://cve.radiocsirt.org/vuln/ghsa-5j7q-wmh7-cqhg GHSA-5j7q-wmh7-cqhg — TYPO3 CMS Allows Broken Access Control in Edit Document Controller 2026-10-02T14:10:38.403197+00:00

Affected: Packagist: typo3/cms-backend

### Problem By exploiting the `defVals` parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability to insert arbitrary data into prohibited exclude fields of a database table for which the user already has write permission for a reduced set of fields.

### Solution Update to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described.

### Credits Thanks to Daniel Windloff for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it.

### References * [TYPO3-CORE-SA-2026-001](https://typo3.org/security/advisory/typo3-core-sa-2026-001)

 https://cve.radiocsirt.org/vuln/ncsc-2026-0018 NCSC-2026-0018 — Kwetsbaarheden verholpen in TYPO3 CMS 2026-10-02T14:10:38.403269+00:00 NCSC-2026-0018 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0095 WID-SEC-W-2026-0095 — TYPO3 Core: Mehrere Schwachstellen 2026-10-02T14:10:38.403294+00:00

Ein entfernter, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in TYPO3 Core ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, um potenziell Phishing-Angriffe durchzuführen oder einen Denial-of-Service-Zustand zu erzeugen.