https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-22T12:55:23.995905+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2020-28945 cnvd-2020-28945 2026-10-22T12:55:23.999189+00:00 cnvd-2020-28945 https://cve.radiocsirt.org/vuln/euvd-2026-40343 EUVD-2026-40343 2026-10-22T12:55:23.999252+00:00 EUVD-2026-40343 https://cve.radiocsirt.org/vuln/fkie_cve-2020-11067 fkie_cve-2020-11067 2026-10-22T12:55:23.999274+00:00

In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that backend user settings (in $BE_USER->uc) are vulnerable to insecure deserialization. In combination with vulnerabilities of third party components, this can lead to remote code execution. A valid backend user account is needed to exploit this vulnerability. This has been fixed in 9.5.17 and 10.4.2.

 https://cve.radiocsirt.org/vuln/ghsa-2wj9-434x-9hvp GHSA-2wj9-434x-9hvp — Insecure Deserialization in Backend User Settings in TYPO3 CMS 2026-10-22T12:55:23.999318+00:00

Affected: Packagist: typo3/cms-core, Packagist: typo3/cms

It has been discovered that backend user settings (in $BE_USER->uc) are vulnerable to insecure deserialization. In combination with vulnerabilities of 3rd party components this can lead to remote code execution. A valid backend user account is needed to exploit this vulnerability.

Update to TYPO3 versions 9.5.17 or 10.4.2 that fix the problem described.

### References * https://typo3.org/security/advisory/typo3-core-sa-2020-005

 https://cve.radiocsirt.org/vuln/gsd-2020-11067 gsd-2020-11067 2026-10-22T12:55:23.999363+00:00 gsd-2020-11067