Technology · Packagist
typo3/cms-backend (Packagist) vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 25 vulnerabilities in typo3/cms-backend (Packagist): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-19418, was published on 11 August 2026.
- Last 7 days
- 0
- Last 90 days
- 0
- Critical, all time
- 0
- Exploited in the wild
- 0
About typo3/cms-backend (Packagist)
The typo3/cms-backend package provides the administrative backend interface for the TYPO3 content management system.
Latest typo3/cms-backend (Packagist) vulnerabilities
- CVE-2026-19418: The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 became ineffective in TYPO3 v13.0, where TYPO3 CMS startedhighCVSS 4EPSS 0.2%
- CVE-2026-47352: TYPO3 CMS broken access control in Backend APImediumCVSS 4EPSS 0.4%
- CVE-2026-47351: TYPO3 CMS broken access control in ClipboardmediumCVSS 4EPSS 0.4%
- CVE-2026-6553: TYPO3 CMS Stores Cleartext Password in User Settings ModulehighCVSS 7.5EPSS 0.2%
- CVE-2025-59020: TYPO3 CMS Allows Broken Access Control in Edit Document ControllermediumCVSS 4EPSS 0.3%
- CVE-2025-59017: TYPO3 backend modules have Broken Access ControlmediumCVSS 4EPSS 0.3%
- CVE-2025-59019: TYPO3 CSV download feature information disclosuremediumCVSS 4EPSS 0.2%
- CVE-2025-59014: TYPO3 Bookmark Toolbar vulnerable to denial of servicemediumCVSS 4EPSS 0.3%
- CVE-2025-47941: The TYPO3 CMS Backend has Broken Authentication in Backend MFAlowCVSS 3.1EPSS 0.4%
- CVE-2024-34537: Denial of Service in TYPO3 Bookmark ToolbarlowCVSS 3.1EPSS 0.7%
- CVE-2024-47780: Information Disclosure in TYPO3 Page TreelowCVSS 3.1EPSS 0.3%
- CVE-2010-3715: TYPO3 cross-site scripting (XSS) vulnerability in the RemoveXSS function and the backendinfoEPSS 1.1%
- CVE-2008-5644: TYPO3 Cross-site Scripting vulnerability in the file backend moduleinfoEPSS 1.1%
- CVE-2010-3659: TYPO3 Cross-site Scripting vulnerability in the extension manager and backend formslowCVSS 3EPSS 1.3%
- CVE-2009-3628: TYPO3 Backend Discloses Encryption KeyinfoEPSS 1.1%
- CVE-2009-3631: TYPO3 Backend Command Injection via Shell Metacharacters in Uploaded File NameinfoEPSS 2.9%
- CVE-2009-3629: TYPO3 Backend vulnerable to Cross-site ScriptinginfoEPSS 1.5%
- CVE-2009-3630: TYPO3 Backend vulnerable to Frame HijackinginfoEPSS 2.0%
- CVE-2010-3664: TYPO3 is vulnerable to Information Disclosure on the backendlowCVSS 3.1EPSS 1.2%
- CVE-2010-3663: TYPO3 Arbitrary Code Execution vulnerability on the backendlowCVSS 3.1EPSS 2.4%
- CVE-2010-3662: TYPO3 SQL injection vulnerability on the backendlowCVSS 3.1EPSS 1.2%
- CVE-2010-3660: TYPO3 is vulnerable to Cross-Site Scripting (XSS) on the backendlowCVSS 3.1EPSS 0.8%
- CVE-2010-3661: TYPO3 Open Redirection vulnerability on the backendlowCVSS 3.1EPSS 0.9%
- CVE-2021-21370: Cross-Site Scripting in Content Preview (CType menu)lowCVSS 3.1EPSS 0.9%
- CVE-2021-21340: Cross-Site Scripting in Content PreviewlowCVSS 3.1EPSS 0.9%
Most severe typo3/cms-backend (Packagist) vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-6553: TYPO3 CMS Stores Cleartext Password in User Settings ModulehighCVSS 7.5EPSS 0.2%
- CVE-2026-19418: The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 became ineffective in TYPO3 v13.0, where TYPO3 CMS startedhighCVSS 4EPSS 0.2%
- CVE-2026-47352: TYPO3 CMS broken access control in Backend APImediumCVSS 4EPSS 0.4%
- CVE-2026-47351: TYPO3 CMS broken access control in ClipboardmediumCVSS 4EPSS 0.4%
- CVE-2025-59020: TYPO3 CMS Allows Broken Access Control in Edit Document ControllermediumCVSS 4EPSS 0.3%
- CVE-2025-59017: TYPO3 backend modules have Broken Access ControlmediumCVSS 4EPSS 0.3%
- CVE-2025-59014: TYPO3 Bookmark Toolbar vulnerable to denial of servicemediumCVSS 4EPSS 0.3%
- CVE-2025-59019: TYPO3 CSV download feature information disclosuremediumCVSS 4EPSS 0.2%
- CVE-2010-3663: TYPO3 Arbitrary Code Execution vulnerability on the backendlowCVSS 3.1EPSS 2.4%
- CVE-2010-3664: TYPO3 is vulnerable to Information Disclosure on the backendlowCVSS 3.1EPSS 1.2%
Vulnerabilities per week
Nothing was published in the last eight weeks. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many typo3/cms-backend (Packagist) vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/typo3-cms-backend)<a href="https://junglewise.ai/threats/technologies/typo3-cms-backend"><img src="https://junglewise.ai/threats/technologies/typo3-cms-backend/badge.svg" alt="typo3/cms-backend (Packagist) vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/typo3-cms-backend.json, and this page as text at https://junglewise.ai/threats/technologies/typo3-cms-backend.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "typo3/cms-backend (Packagist) vulnerabilities", https://junglewise.ai/threats/technologies/typo3-cms-backend, 10 November 2026.