Vulnerabilidades em TYPO3

198 resultados
Análise Vexday

O ecossistema de vulnerabilidades do TYPO3 acumula 141 CVEs catalogadas, com 24 registros surgidos nos últimos 90 dias, o que indica um ritmo contínuo de descobertas que merece acompanhamento. Nenhuma das vulnerabilidades está listada no catálogo CISA KEV e não há PoCs públicas conhecidas, colocando a taxa de exploração ativa abaixo da média geral do catálogo — um indicador favorável, mas não suficiente para reduzir a vigilância. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão que exige atenção especial em implementações que aceitam entrada de usuários sem sanitização adequada. A CVE mais perigosa atualmente rastreada é CVE-2026-46725, com score EPSS de 0,0231, sugerindo probabilidade de exploração ainda baixa, mas que deve ser monitorada dado o contexto das 2 vulnerabilidades de severidade crítica presentes no portfólio.

CVE-2026-49738LOWTYPO3 CMS - Broken Access Control in File Abstraction LayerEPSS 0.4%CVE-2025-12998HIGHBroken Authentication in extension “Modules” (modules)EPSS 0.4%CVE-2026-113459HIGHSensitive Data Exposure in extension "TYPO3 AI Integration Extension" (ns_t3ai)EPSS 0.4%CVE-2026-77127MEDIUMInformation Disclosure in extension "Modules" (modules)EPSS 0.4%CVE-2026-77133MEDIUMBroken Access Control in extension "femanager" (femanager)EPSS 0.4%CVE-2026-77145HIGHBroken Access Control in extension "Events 2" (events2)EPSS 0.4%CVE-2026-77130MEDIUMInsufficient Session Expiration in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)EPSS 0.4%CVE-2026-112239HIGHBroken Access Control in extension "TYPO3 AI Integration Extension" (ns_t3ai)EPSS 0.4%CVE-2026-120327MEDIUMOpen Redirection in extension "Mail" (mail)EPSS 0.3%CVE-2025-10316LOWCross-Site Scripting in extension "Form to Database" (form_to_database)EPSS 0.3%CVE-2026-56094MEDIUMInformation Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)EPSS 0.3%CVE-2025-7899MEDIUMInsecure Direct Object Reference in extension "powermail" (powermail)EPSS 0.3%CVE-2026-8827HIGHSQL Injection in extension "Address List" (tt_address)EPSS 0.3%CVE-2024-55891LOWInformation Disclosure via Exception Handling/Logger in TYPO3EPSS 0.3%CVE-2026-112065MEDIUMMissing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)EPSS 0.3%CVE-2026-112068MEDIUMInsecure Direct Object Reference in extension "Analytics" (analytics)EPSS 0.3%CVE-2026-112070MEDIUMBroken Access Control in extension "Analytics" (analytics)EPSS 0.3%CVE-2023-50462MEDIUMAn issue was discovered in the content_consent (aka Content Consent) extension through 2.0.1 for TYPO3. It fails to verify whether a specifiEPSS 0.3%CVE-2026-56095HIGHInsecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)EPSS 0.3%CVE-2026-46723MEDIUMInformation Disclosure in extension "Faceted Search" (ke_search)EPSS 0.3%