CVE-2026-28616

The Setup Wizard contains a confused deputy vulnerability that allows an attacker to force a connection to a malicious network. This flaw can lead to a local escalation of privilege without requiring additional execution privileges or user interaction. While the vulnerability is documented across...

CVE-2026-28616

In Setup Wizard, there is a possible way to force connection to a malicious network due to confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28616

In Setup Wizard, there is a possible way to force connection to a malicious network due to confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-77132

It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements that fall outside of their permitted range. Exploiting...

CVE-2026-77132 TYPO3 CMS - Information Disclosure via Backend Localization Wizard

It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements that fall outside of their permitted range. Exploiting...

CVE-2026-77132 TYPO3 CMS - Information Disclosure via Backend Localization Wizard

It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements that fall outside of their permitted range. Exploiting...

CVE-2026-77132

TYPO3 CMS is vulnerable to an information disclosure flaw in the backend localization wizard . Several AJAX routes used by this feature failed to perform authorization checks, allowing authenticated, low-privileged backend users to access information about records and content elements outside the...

CVE-2026-77132 TYPO3 CMS - Information Disclosure via Backend Localization Wizard

It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements that fall outside of their permitted range. Exploiting...

EUVD-2026-72676

It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements that fall outside of their permitted range. Exploiting...

TYPO3-CORE-SA-2026-022: Information Disclosure via Backend Localization Wizard

More info at https://news.typo3.com/security/advisory/typo3-core-sa-2026-022...

PT-2026-87020

It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements that fall outside of their permitted range. Exploiting...

PT-2026-88215

In Setup Wizard, there is a possible way to force connection to a malicious network due to confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28616: Unintended Proxy or Intermediary

In Setup Wizard, there is a possible way to force connection to a malicious network due to confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PUB-A-483044524

In the Setup Wizard, there is a possible remote package install due to a missing permission check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

ASB-A-483923525

In Setup Wizard, there is a possible way to force connection to a malicious network due to confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (6.3.0), com.airbus-cyber-security.graylog:graylog-plugin-correlation-count (6.3.0) +3 more potentially affected by CVE-2026-55867 via org.graylog2:graylog2-server (>=6.2.0, <=6.3.11)

org.graylog2:graylog2-server MAVEN version =6.2.0, =6.2.0, =6.2.0, =6.3.11 Source cves: CVE-2026-55867 Source advisory: GHSA-J769-9GV9-65GR...

com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (7.0.0), com.airbus-cyber-security.graylog:graylog-plugin-correlation-count (7.0.0) +3 more potentially affected by CVE-2026-55867 via org.graylog2:graylog2-server (>=7.0.0, <=7.0.6)

org.graylog2:graylog2-server MAVEN version =7.0.0, =7.0.0, =7.0.0, =7.0.6 Source cves: CVE-2026-55867 Source advisory: SNYK:JAVA-ORGGRAYLOG2-19456649...

com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (6.3.0), com.airbus-cyber-security.graylog:graylog-plugin-correlation-count (6.3.0) +3 more potentially affected by CVE-2026-55867 via org.graylog2:graylog2-server (>=6.2.0, <=6.3.11)

org.graylog2:graylog2-server MAVEN version =6.2.0, =6.2.0, =6.2.0, =6.3.11 Source cves: CVE-2026-55867 Source advisory: SNYK:JAVA-ORGGRAYLOG2-19456649...

com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (7.0.0), com.airbus-cyber-security.graylog:graylog-plugin-correlation-count (7.0.0) +3 more potentially affected by CVE-2026-55867 via org.graylog2:graylog2-server (>=7.0.0, <=7.0.6)

org.graylog2:graylog2-server MAVEN version =7.0.0, =7.0.0, =7.0.0, =7.0.6 Source cves: CVE-2026-55867 Source advisory: OSV:GHSA-J769-9GV9-65GR...

com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (7.0.0), com.airbus-cyber-security.graylog:graylog-plugin-correlation-count (7.0.0) +3 more potentially affected by CVE-2026-55867 via org.graylog2:graylog2-server (>=7.0.0, <=7.0.6)

org.graylog2:graylog2-server MAVEN version =7.0.0, =7.0.0, =7.0.0, =7.0.6 Source cves: CVE-2026-55867 Source advisory: MEND:CVE-2026-55867...