https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T08:30:42.672940+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2022-avi-549 certfr-2022-avi-549 — De multiples vulnérabilités ont été découvertes dans TYPO3. Elles permettent à un attaquant de provoquer un contourneme… 2026-10-08T08:30:42.676099+00:00 certfr-2022-avi-549 https://cve.radiocsirt.org/vuln/euvd-2026-234037 EUVD-2026-234037 2026-10-08T08:30:42.676144+00:00 EUVD-2026-234037 https://cve.radiocsirt.org/vuln/fkie_cve-2022-31049 fkie_cve-2022-31049 2026-10-08T08:30:42.676159+00:00

TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, user submitted content was used without being properly encoded in HTML emails sent to users. The actually affected components were mail clients used to view those messages. TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem.

 https://cve.radiocsirt.org/vuln/ghsa-h4mx-xv96-2jgm GHSA-h4mx-xv96-2jgm — Cross-Site Scripting in TYPO3's Frontend Login Mailer 2026-10-08T08:30:42.676190+00:00

Affected: Packagist: typo3/cms-core, Packagist: typo3/cms

> ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (4.9)

### Problem User submitted content was used without being properly encoded in HTML emails sent to users. The actually affected components were mail clients used to view those messages.

### Solution Update to TYPO3 versions 9.5.35 ELTS, 10.4.29, 11.5.11 that fix the problem described above.

### Credits Thanks to Christian Seifert who reported this issue and to TYPO3 framework merger Andreas Fernandez who fixed the issue.

### References * [TYPO3-CORE-SA-2022-004](https://typo3.org/security/advisory/typo3-core-sa-2022-004)

 https://cve.radiocsirt.org/vuln/gsd-2022-31049 gsd-2022-31049 2026-10-08T08:30:42.676223+00:00 gsd-2022-31049