https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T16:24:26.664991+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-325667 EUVD-2026-325667 2026-10-03T16:24:26.669157+00:00 EUVD-2026-325667 https://cve.radiocsirt.org/vuln/fkie_cve-2026-47344 fkie_cve-2026-47344 2026-10-03T16:24:26.669195+00:00

When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\t>) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.

 https://cve.radiocsirt.org/vuln/ghsa-jvf5-rxvv-3mcg GHSA-jvf5-rxvv-3mcg — TYPO3 HTML Sanitizer allows Cross-site Scripting 2026-10-03T16:24:26.669234+00:00

Affected: Packagist: typo3/html-sanitizer

When `ALLOW_INSECURE_RAW_TEXT` is enabled, whitespace-variant closing tags (e.g., `</style\\t>`) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization. This allows bypassing the cross-site scripting prevention mechanism of `typo3/html-sanitizer` before version 2.3.2.

Credits to IPC Labs for reporting this vulnerability.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1835 WID-SEC-W-2026-1835 — TYPO3 Core: Mehrere Schwachstellen 2026-10-03T16:24:26.669261+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in TYPO3 Core ausnutzen, um Sicherheitsbeschränkungen zu umgehen, Benutzer auf schädliche Websites umzuleiten, beliebigen Code auszuführen, Berechtigungen zu eskalieren oder andere Auswirkungen zu verursachen.