TYPO3-EXT-SA-2026-023: Broken Access Control in extension "Event management and registration" (sf_event_mgt)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-023...

TYPO3-EXT-SA-2026-015: Insufficient Session Expiration in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-015...

TYPO3-EXT-SA-2026-027: SQL Injection in extension "Forms Export" (frp_form_answers)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-027...

TYPO3-EXT-SA-2026-021: Broken Access Control in extension "Forum" (pforum)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-021...

TYPO3-EXT-SA-2026-026: Broken Access Control in extension "Events 2" (events2)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-026...

Improper access control in the newsletter module (see GHSA-3r9g-pfhv-3228)

More info at https://contao.org/en/security-advisories/improper-access-control-in-the-newsletter-module...

Cross-site scripting in the comments bundle (see GHSA-628f-v4f6-p37r)

More info at https://contao.org/en/security-advisories/cross-site-scripting-in-the-comments-bundle...

Custom action dispatcher bypasses access_control on other routes

Summary EasyAdmin serves all backend requests through a single dashboard route and, for custom actions Action::linkToRoute / MenuItem::linkToRoute, swaps the executed controller based on the routeName query parameter on the kernel.controller event. That swap happens after Symfony's security...

Cross-site scripting in the frontend search results (see GHSA-h57j-5f5m-789v)

More info at https://contao.org/en/security-advisories/cross-site-scripting-in-the-frontend-search-results...

Improper access control in the table access voter (see GHSA-5974-gfqc-wrcm)

More info at https://contao.org/en/security-advisories/improper-access-control-in-the-table-access-voter...

Cross-site scripting in the comments bundle (see GHSA-628f-v4f6-p37r)

More info at https://contao.org/en/security-advisories/cross-site-scripting-in-the-comments-bundle...

Unrestricted activation email resending (see GHSA-mfxh-vp55-7gc6)

More info at https://contao.org/en/security-advisories/unrestricted-activation-email-resending...

Improper access control in the newsletter module (see GHSA-3r9g-pfhv-3228)

More info at https://contao.org/en/security-advisories/improper-access-control-in-the-newsletter-module...

Exposure of sensitive information through a stale search index (see GHSA-x2rp-9qf7-2fmq)

More info at https://contao.org/en/security-advisories/exposure-of-sensitive-information-through-a-stale-search-index...

Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS in react/http

More info at https://github.com/reactphp/http/security/advisories/GHSA-g4f2-2pf3-2pwj...

A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU

More info at https://github.com/reactphp/http/security/advisories/GHSA-x424-64qh-5j54...

TYPO3-CORE-SA-2026-023: Missing Authorization in lowlevel commands

More info at https://news.typo3.com/security/advisory/typo3-core-sa-2026-023...

TYPO3-CORE-SA-2026-022: Information Disclosure via Backend Localization Wizard

More info at https://news.typo3.com/security/advisory/typo3-core-sa-2026-022...

TYPO3-EXT-SA-2026-014: Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-014...