https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-16T08:07:14.413204+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2022-17974 cnvd-2022-17974 2026-10-16T08:07:14.417216+00:00 cnvd-2022-17974 https://cve.radiocsirt.org/vuln/euvd-2026-29474 EUVD-2026-29474 2026-10-16T08:07:14.417263+00:00 EUVD-2026-29474 https://cve.radiocsirt.org/vuln/fkie_cve-2021-36787 fkie_cve-2021-36787 2026-10-16T08:07:14.417288+00:00

The femanager extension before 5.5.1 and 6.x before 6.3.1 for TYPO3 allows XSS via a crafted SVG document.

 https://cve.radiocsirt.org/vuln/ghsa-f3rf-v9qm-9c89 GHSA-f3rf-v9qm-9c89 — Cross-site Scripting in the femanager TYPO3 extension 2026-10-16T08:07:14.417328+00:00

Affected: Packagist: in2code/femanager

The extension allows by default to upload SVG files when a logged in frontend user uploads a new profile image. This may lead to Cross-Site Scripting, when the uploaded SVG image is used as is on the website.

Note: If SVG uploads are required, it is recommended to use the TYPO3 extension svg_sanitizer (added to TYPO3 core since versions 9.5.28, 10.4.18 and 11.3.0) to prevent upload of malicious SVG files or to set up a strict Content Security Policy for the destination folder of uploaded images.

 https://cve.radiocsirt.org/vuln/gsd-2021-36787 gsd-2021-36787 2026-10-16T08:07:14.417372+00:00 gsd-2021-36787