https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 15:30:28 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0037 certfr-2026-avi-0037 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0037 https://cve.radiocsirt.org/vuln/euvd-2026-265555 EUVD-2026-265555 https://cve.radiocsirt.org/vuln/euvd-2026-265555 https://cve.radiocsirt.org/vuln/fkie_cve-2025-59020 <p>By exploiting the defVals parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability to insert arbitrary data into prohibited exclude fields of a database table for which the user already has write permission for a reduced set of fields. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.</p> <p>By exploiting the defVals parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability to insert arbitrary data into prohibited exclude fields of a database table for which the user already has write permission for a reduced set of fields. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-59020 https://cve.radiocsirt.org/vuln/ghsa-5j7q-wmh7-cqhg <p><strong>Affected:</strong> Packagist: typo3/cms-backend</p> <p>### Problem By exploiting the `defVals` parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability to insert arbitrary data into prohibited exclude fields of a database table for which the user already has write permission for a reduced set of fields.</p> <p>### Solution Update to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described.</p> <p>### Credits Thanks to Daniel Windloff for reporting this issue, and to TYPO3 core &amp; security team member Benjamin Franzke for fixing it.</p> <p>### References * [TYPO3-CORE-SA-2026-001](https://typo3.org/security/advisory/typo3-core-sa-2026-001)</p> <p><strong>Affected:</strong> Packagist: typo3/cms-backend</p> <p>### Problem By exploiting the `defVals` parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability to insert arbitrary data into prohibited exclude fields of a database table for which the user already has write permission for a reduced set of fields.</p> <p>### Solution Update to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described.</p> <p>### Credits Thanks to Daniel Windloff for reporting this issue, and to TYPO3 core &amp; security team member Benjamin Franzke for fixing it.</p> <p>### References * [TYPO3-CORE-SA-2026-001](https://typo3.org/security/advisory/typo3-core-sa-2026-001)</p> https://cve.radiocsirt.org/vuln/ghsa-5j7q-wmh7-cqhg https://cve.radiocsirt.org/vuln/ncsc-2026-0018 NCSC-2026-0018 https://cve.radiocsirt.org/vuln/ncsc-2026-0018 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0095 <p>Ein entfernter, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in TYPO3 Core ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, um potenziell Phishing-Angriffe durchzuführen oder einen Denial-of-Service-Zustand zu erzeugen.</p> <p>Ein entfernter, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in TYPO3 Core ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, um potenziell Phishing-Angriffe durchzuführen oder einen Denial-of-Service-Zustand zu erzeugen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0095