TYPO3 vulnerabilities - every known CVE across core and extensions
TYPO3 is widely deployed by European enterprises and public-sector sites, where its extension ecosystem is the most frequent source of newly disclosed CVEs.
typo3 security
Every published CVE affecting typo3
This list contains every CVE that names typo3 as an affected product. Records come from the official CVE feeds maintained by MITRE and NIST. Each record includes a CVSS severity score, the affected version range, and a link to the full NVD entry. New records usually appear here within minutes of publication.
Third-party plugins, extensions, and add-ons built on top of typo3 are included alongside the core product. In most CMS ecosystems, the majority of CVEs come from the extension layer rather than the core application itself. Searching by component name is just as important as searching by platform name.
Understanding CVSS scores
Severity ratings explained
Every CVE has a CVSS 3.x score from 0 to 10. The score is based on how the vulnerability can be reached (over the network or locally), how complex the exploit is, what access an attacker needs beforehand, whether a victim has to do something first, and the impact on confidentiality, integrity, and availability if the attack succeeds.
Search by component name, vendor, or keyword to filter this list. Click any CVE ID to see the full record. If your installed version falls within the affected range, update immediately or check the vendor's security advisory.
| CVE ID | Severity | CVSS | Title | Published |
|---|---|---|---|---|
| CVE-2026-15305 | medium | 6.3/10 | Jul 14, 2026 23d ago | |
| CVE-2026-49742 | high | 7.1/10 | Jun 9, 2026 1mo ago | |
| CVE-2026-49741 | high | 8.7/10 | Jun 9, 2026 1mo ago | |
| CVE-2026-49740 | medium | 6.3/10 | Jun 9, 2026 1mo ago | |
| CVE-2026-49738 | low | 2.1/10 | Jun 9, 2026 1mo ago | |
| CVE-2026-47352 | medium | 5.3/10 | Jun 9, 2026 1mo ago | |
| CVE-2026-47351 | medium | 5.3/10 | Jun 9, 2026 1mo ago | |
| CVE-2026-47350 | medium | 5.3/10 | Jun 9, 2026 1mo ago | |
| CVE-2026-47349 | medium | 5.3/10 | Jun 9, 2026 1mo ago | |
| CVE-2026-47348 | medium | 5.1/10 | Jun 9, 2026 1mo ago | |
| CVE-2026-47347 | medium | 5.3/10 | Jun 9, 2026 1mo ago | |
| CVE-2026-47346 | high | 7.6/10 | Jun 9, 2026 1mo ago | |
| CVE-2026-47343 | high | 7.2/10 | Jun 9, 2026 1mo ago | |
| CVE-2026-11607 | high | 7.6/10 | Jun 9, 2026 1mo ago | |
| CVE-2026-47345 | medium | 5.1/10 | Jun 8, 2026 1mo ago | |
| CVE-2026-47344 | low | 2.1/10 | Jun 8, 2026 1mo ago | |
| CVE-2026-6553 | high | 7.3/10 | Apr 21, 2026 3mo ago | |
| CVE-2026-0859 | medium | 5.2/10 | Jan 13, 2026 6mo ago | |
| CVE-2025-59022 | high | 7.1/10 | Jan 13, 2026 6mo ago | |
| CVE-2025-59021 | medium | 5.3/10 | Jan 13, 2026 6mo ago | |
| CVE-2025-59020 | medium | 5.3/10 | Jan 13, 2026 6mo ago | |
| CVE-2025-59014 | medium | 5.1/10 | Sep 9, 2025 11mo ago | |
| CVE-2025-59013 | medium | 5.3/10 | Sep 9, 2025 11mo ago | |
| CVE-2025-9573 | high | 8.6/10 | Sep 2, 2025 11mo ago | |
| CVE-2025-47941 | high | 7.2/10 | May 20, 2025 1y ago | |
| CVE-2025-47940 | high | 7.2/10 | May 20, 2025 1y ago | |
| CVE-2025-47939 | medium | 5.4/10 | May 20, 2025 1y ago | |
| CVE-2025-47938 | low | 3.8/10 | May 20, 2025 1y ago | |
| CVE-2025-47937 | low | 3.7/10 | May 20, 2025 1y ago | |
| CVE-2025-47936 | low | 3.3/10 | May 20, 2025 1y ago |
