https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T03:42:24.971088+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-319424 EUVD-2026-319424 2026-10-04T03:42:24.974513+00:00 EUVD-2026-319424 https://cve.radiocsirt.org/vuln/fkie_cve-2026-46725 fkie_cve-2026-46725 2026-10-04T03:42:24.974549+00:00

The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server. Exploitation requires the content element to be configured with "Persistent Mode: Static" in the plugin settings.

 https://cve.radiocsirt.org/vuln/ghsa-8x3j-439w-537c GHSA-8x3j-439w-537c — TYPO3 Remote Code Execution in extension "Content Element Selector" (ceselector) 2026-10-04T03:42:24.974583+00:00

Affected: Packagist: mmc/ceselector

The TYPO3 "Content Element Selector" (ceselector) extension passes an attacker-controlled cookie directly to PHP's `unserialize()` without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server. Exploitation requires the content element to be configured with `Persistent Mode: Static` in the plugin settings. This has been patched in version 3.0.3, 4.0.2, 5.0.1, and 6.0.1.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1585 WID-SEC-W-2026-1585 — TYPO3 Extensions: Mehrere Schwachstellen 2026-10-04T03:42:24.974612+00:00

Ein Angreifer kann mehrere Schwachstellen in TYPO3 Extensions ausnutzen, um beliebigen Programmcode auszuführen, um einen SQL-Injection Angriff durchzuführen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.