Product by TYPO3
Typo3 CMS
54 known vulnerabilities in Typo3 CMS (TYPO3), 0 of them actively exploited (CISA KEV).
Key figures
54
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2020-15098 | Missing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMS | 8.8 | |
| High | CVE-2020-11067 | Deserialization of Untrusted Data in TYPO3 CMS | 8.8 | |
| High | CVE-2020-15099 | Exposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMS | 8.1 | |
| High | CVE-2021-21355 | Unrestricted File Upload in Form Framework | 8.6 | |
| Critical | CVE-2020-11066 | Improperly Controlled Modification of Dynamically-Determined Object Attributes in TYPO3 CMS | 8.7 | |
| High | CVE-2021-21357 | Broken Access Control in Form Framework | 8.3 | |
| High | CVE-2021-21359 | Denial of Service in Page Error Handling | 5.9 | |
| High | CVE-2026-85400 | TYPO3 CMS - Missing Authorization in lowlevel commands | — | |
| Medium | CVE-2026-109162 | TYPO3 CMS - Security Misconfiguration in Form Framework | — | |
| High | CVE-2025-59022 | TYPO3 CMS Allows Broken Access Control in Recycler Module | 8.1 | |
| High | CVE-2020-11069 | Cross-Site Request Forgery in TYPO3 CMS | 8.0 | |
| High | CVE-2026-49741 | TYPO3 CMS - Privilege Escalation & SQL Injection in Form Framework | — | |
| Medium | CVE-2026-77132 | TYPO3 CMS - Information Disclosure via Backend Localization Wizard | — | |
| High | CVE-2020-26228 | Cleartext storage of session identifier | 8.1 | |
| High | CVE-2026-19418 | TYPO3 CMS - Broken Access Control in Backend and Install Tool | — | |
| High | CVE-2025-59017 | Broken Access Control in Backend AJAX Routes | 8.8 | |
| High | CVE-2026-47346 | TYPO3 CMS - Broken Access Control in Form Framework | — | |
| High | CVE-2021-21339 | Cleartext storage of session identifier | 5.9 | |
| High | CVE-2026-49742 | TYPO3 CMS - Broken Access Control in Media Module | — | |
| Medium | CVE-2021-21338 | Open Redirection in Login Handling | 4.7 | |
| High | CVE-2026-11607 | TYPO3 CMS - Broken Access Control in Form Framework | — | |
| Low | CVE-2020-11063 | Observable Response Discrepancy in TYPO3 CMS | 3.7 | |
| High | CVE-2026-47343 | TYPO3 CMS - Destructive Actions on File Mount Folders | — | |
| Medium | CVE-2021-21370 | Cross-Site Scripting in Content Preview (CType menu) | 5.4 | |
| Medium | CVE-2021-21340 | Cross-Site Scripting in Content Preview | 5.4 |