TYPO3-EXT-SA-2026-021: Broken Access Control in extension "Forum" (pforum)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-021...

TYPO3-EXT-SA-2026-015: Cleartext Transmission of Sensitive Information in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-015...

TYPO3-EXT-SA-2026-019: Broken Access Control in extension "Club Directory" (clubdirectory)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-019...

TYPO3-EXT-SA-2026-017: Path Traversal in extension "Mask" (mask)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-017...

TYPO3-EXT-SA-2026-026: Broken Access Control in extension "Events 2" (events2)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-026...

TYPO3-EXT-SA-2026-024: Broken Access Control in extension "femanager" (femanager)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-024...

TYPO3-EXT-SA-2026-024: Broken Access Control in extension "femanager" (femanager)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-024...

TYPO3-EXT-SA-2026-025: Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-025...

Improper access control in the newsletter module (see GHSA-3r9g-pfhv-3228)

More info at https://contao.org/en/security-advisories/improper-access-control-in-the-newsletter-module...

Improper access control in the CSV import wizard (see GHSA-23w9-4pg3-xwm3)

More info at https://contao.org/en/security-advisories/improper-access-control-in-the-csv-import-wizard...

Improper access control in the CSV import wizard (see GHSA-23w9-4pg3-xwm3)

More info at https://contao.org/en/security-advisories/improper-access-control-in-the-csv-import-wizard...

Improper access control in the table access voter (see GHSA-5974-gfqc-wrcm)

More info at https://contao.org/en/security-advisories/improper-access-control-in-the-table-access-voter...

Improper access control in the preview links module (see GHSA-q6wp-fr43-gm9v)

More info at https://contao.org/en/security-advisories/improper-access-control-in-the-preview-links-module...

Cross-site scripting in the frontend search results (see GHSA-h57j-5f5m-789v)

More info at https://contao.org/en/security-advisories/cross-site-scripting-in-the-frontend-search-results...

Path traversal in the images controller (see GHSA-mrvp-7wmx-5m4h)

More info at https://contao.org/en/security-advisories/path-traversal-in-the-images-controller...

Non-admin users can self-grant permissions that implicitly make them administrators (see GHSA-r9qp-pqx5-8369)

More info at https://contao.org/en/security-advisories/non-admin-users-can-self-grant-permissions-that-implicitly-make-them-administrators...

Non-admin users can self-grant permissions that implicitly make them administrators (see GHSA-r9qp-pqx5-8369)

More info at https://contao.org/en/security-advisories/non-admin-users-can-self-grant-permissions-that-implicitly-make-them-administrators...

Cross-site scripting in the comments bundle (see GHSA-628f-v4f6-p37r)

More info at https://contao.org/en/security-advisories/cross-site-scripting-in-the-comments-bundle...

Improper access control in the newsletter module (see GHSA-3r9g-pfhv-3228)

More info at https://contao.org/en/security-advisories/improper-access-control-in-the-newsletter-module...

Improper access control in the table access voter (see GHSA-5974-gfqc-wrcm)

More info at https://contao.org/en/security-advisories/improper-access-control-in-the-table-access-voter...

Improper access control in the table access voter (see GHSA-5974-gfqc-wrcm)

More info at https://contao.org/en/security-advisories/improper-access-control-in-the-table-access-voter...

Cross-site request forgery in custom backend actions (see GHSA-9ff2-p842-45wq)

More info at https://contao.org/en/security-advisories/cross-site-request-forgery-in-custom-backend-actions...

Improper access control in the CSV import wizard (see GHSA-23w9-4pg3-xwm3)

More info at https://contao.org/en/security-advisories/improper-access-control-in-the-csv-import-wizard...

Path traversal in the images controller (see GHSA-mrvp-7wmx-5m4h)

More info at https://contao.org/en/security-advisories/path-traversal-in-the-images-controller...

Exposure of sensitive information through a stale search index (see GHSA-x2rp-9qf7-2fmq)

More info at https://contao.org/en/security-advisories/exposure-of-sensitive-information-through-a-stale-search-index...

Cross-site scripting in the comments bundle (see GHSA-628f-v4f6-p37r)

More info at https://contao.org/en/security-advisories/cross-site-scripting-in-the-comments-bundle...

Improper access control in the newsletter module (see GHSA-3r9g-pfhv-3228)

More info at https://contao.org/en/security-advisories/improper-access-control-in-the-newsletter-module...

Unrestricted activation email resending (see GHSA-mfxh-vp55-7gc6)

More info at https://contao.org/en/security-advisories/unrestricted-activation-email-resending...

Improper access control in the preview links module (see GHSA-q6wp-fr43-gm9v)

More info at https://contao.org/en/security-advisories/improper-access-control-in-the-preview-links-module...

Cross-site scripting in the frontend search results (see GHSA-h57j-5f5m-789v)

More info at https://contao.org/en/security-advisories/cross-site-scripting-in-the-frontend-search-results...

Improper access control in the CSV import wizard (see GHSA-23w9-4pg3-xwm3)

More info at https://contao.org/en/security-advisories/improper-access-control-in-the-csv-import-wizard...

Cross-site scripting in the frontend search results (see GHSA-h57j-5f5m-789v)

More info at https://contao.org/en/security-advisories/cross-site-scripting-in-the-frontend-search-results...

Non-admin users can self-grant permissions that implicitly make them administrators (see GHSA-r9qp-pqx5-8369)

More info at https://contao.org/en/security-advisories/non-admin-users-can-self-grant-permissions-that-implicitly-make-them-administrators...

Improper access control in the newsletter module (see GHSA-3r9g-pfhv-3228)

More info at https://contao.org/en/security-advisories/improper-access-control-in-the-newsletter-module...

Non-admin users can self-grant permissions that implicitly make them administrators (see GHSA-r9qp-pqx5-8369)

More info at https://contao.org/en/security-advisories/non-admin-users-can-self-grant-permissions-that-implicitly-make-them-administrators...

Unrestricted activation email resending (see GHSA-mfxh-vp55-7gc6)

More info at https://contao.org/en/security-advisories/unrestricted-activation-email-resending...

Cross-site request forgery in custom backend actions (see GHSA-9ff2-p842-45wq)

More info at https://contao.org/en/security-advisories/cross-site-request-forgery-in-custom-backend-actions...

Unrestricted activation email resending (see GHSA-mfxh-vp55-7gc6)

More info at https://contao.org/en/security-advisories/unrestricted-activation-email-resending...

Exposure of sensitive information through a stale search index (see GHSA-x2rp-9qf7-2fmq)

More info at https://contao.org/en/security-advisories/exposure-of-sensitive-information-through-a-stale-search-index...

Path traversal in the images controller (see GHSA-mrvp-7wmx-5m4h)

More info at https://contao.org/en/security-advisories/path-traversal-in-the-images-controller...

Unrestricted activation email resending (see GHSA-mfxh-vp55-7gc6)

More info at https://contao.org/en/security-advisories/unrestricted-activation-email-resending...

Cross-site request forgery in custom backend actions (see GHSA-9ff2-p842-45wq)

More info at https://contao.org/en/security-advisories/cross-site-request-forgery-in-custom-backend-actions...

Cross-site scripting in the comments bundle (see GHSA-628f-v4f6-p37r)

More info at https://contao.org/en/security-advisories/cross-site-scripting-in-the-comments-bundle...

Exposure of sensitive information through a stale search index (see GHSA-x2rp-9qf7-2fmq)

More info at https://contao.org/en/security-advisories/exposure-of-sensitive-information-through-a-stale-search-index...

Cross-site request forgery in custom backend actions (see GHSA-9ff2-p842-45wq)

More info at https://contao.org/en/security-advisories/cross-site-request-forgery-in-custom-backend-actions...

Improper access control in the table access voter (see GHSA-5974-gfqc-wrcm)

More info at https://contao.org/en/security-advisories/improper-access-control-in-the-table-access-voter...

Exposure of sensitive information through a stale search index (see GHSA-x2rp-9qf7-2fmq)

More info at https://contao.org/en/security-advisories/exposure-of-sensitive-information-through-a-stale-search-index...

Cross-site scripting in the frontend search results (see GHSA-h57j-5f5m-789v)

More info at https://contao.org/en/security-advisories/cross-site-scripting-in-the-frontend-search-results...

Cross-site scripting in the comments bundle (see GHSA-628f-v4f6-p37r)

More info at https://contao.org/en/security-advisories/cross-site-scripting-in-the-comments-bundle...

Cross-site scripting in the Colorbox caption (see GHSA-rr85-7j77-pppg)

More info at https://github.com/contao-components/colorbox/security/advisories/GHSA-rr85-7j77-pppg...