Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Problem Editors with access to create or modify page content were able to include HTML markup in page titles that were stored in the search index without sanitization. When displayed in frontend search results via the Indexed Search plugin, these titles were rendered without proper output encoding, resulting in a Cross-Site Scripting vulnerability. Solution Update to TYPO3 versions 13.4.31 LTS, 14.3.3 LTS that fix the problem described. Credits TYPO3 CMS thanks Jan Kahmen and Sanjay Singh Jhala for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. Resources TYPO3-CORE-SA-2026-010
Recommended action: Upgrade to 14.3.3 or 13.4.31 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Problem A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation of this vulnerability requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend, which can occur under the following conditions: the user opens a malicious link, such as one sent via email. the user visits a compromised or manipulated website while the following settings are misconfigured: + security.backend.enforceReferrer feature is disabled, + BE/cookieSameSite configuration is set to lax or none The vulnerability in the affected downstream component “Indexed Search Module” allows attackers to delete items of the…
Recommended action: Upgrade to 13.4.3, 12.4.25, 11.5.42 or 10.4.48 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.