How many CVEs does TYPO3 have?

TYPO3 has 565 published CVE records since 2006, including 70 in the last two years.

How many TYPO3 CVEs are in CISA KEV?

None of TYPO3's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which TYPO3 products have the most CVEs?

The TYPO3 products with the most published CVEs are typo3, TYPO3.CMS, TYPO3 CMS, HTML Sanitizer, html-sanitizer.

What are the most common weakness types in TYPO3 CVEs?

TYPO3's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-862 (Missing Authorization), CWE-502 (Deserialization of Untrusted Data).

Are there public exploits for TYPO3 vulnerabilities?

Yes — 13 of TYPO3's CVEs have a known public exploit.

How many critical TYPO3 vulnerabilities are there?

TYPO3 has 22 critical and 221 high-severity CVEs.

What is the average severity of TYPO3 CVEs?

The average CVSS base score across TYPO3's scored CVEs is 6.2.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

565 CVEs

TYPO3 Vulnerabilities

Name: TYPO3 vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for TYPO3.

565

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

13

Public exploits

PoC or exploit code

6.2

Avg CVSS

2006–2026

Overview

TYPO3 has 565 published CVE records since 2006, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 13 have a known public exploit. The average CVSS base score across scored CVEs is 6.2.

This page aggregates every publicly disclosed vulnerability (CVE) affecting TYPO3 products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on TYPO3's vulnerability posture, as a share of its 565 published CVEs.

Average CVSS: 6.2
Critical / high: 43%
Actively exploited (KEV): 0%
Public exploit available: 2%
Patch available: 48%

Severity and exploitation

How the CVSS severity of TYPO3's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical22

High221

Medium295

Low27

In CISA’s Known Exploited Vulnerabilities catalog

0

None of TYPO3's CVEs are currently listed in CISA's KEV catalog.

Public exploits

13

13 of TYPO3's CVEs have a known public exploit available.

Most affected products

The TYPO3 products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in TYPO3 CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish TYPO3 CVE records.

Disclosure activity by year

How many TYPO3 CVEs were published each year.

2019

37

2020

16

2021

16

2022

17

2023

8

2024

15

2025

37

2026

33

Latest TYPO3 CVEs

The most recently disclosed vulnerabilities affecting TYPO3.

TYPO3 CMS - Unrestricted File Upload in Form Framework
CWE-351
Medium · CVSS 6.3
EPSS 0.2%2026-07-14
TYPO3 CMS - Broken Access Control in Media Module
CWE-22
High · CVSS 7.1
EPSS 0.3%2026-06-09
TYPO3 CMS - Privilege Escalation & SQL Injection in Form Framework
CWE-862
High · CVSS 8.7
EPSS 0.2%2026-06-09
TYPO3 CMS - Insecure Deserialization in Core API
CWE-502
Medium · CVSS 6.3
EPSS 0.2%2026-06-09
TYPO3 CMS - Broken Access Control in File Abstraction Layer
CWE-22
Low · CVSS 2.1
EPSS 0.4%2026-06-09
TYPO3 CMS - Broken Access Control in Backend API
CWE-862
Medium · CVSS 5.3
EPSS 0.2%2026-06-09
TYPO3 CMS - Broken Access Control in Clipboard
CWE-200
Medium · CVSS 5.3
EPSS 0.2%2026-06-09
TYPO3 CMS - Broken Access Control in DataHandler
CWE-862
Medium · CVSS 5.3
EPSS 0.2%2026-06-09
TYPO3 CMS - Broken Access Control in Recycler
CWE-862
Medium · CVSS 5.3
EPSS 0.2%2026-06-09
TYPO3 CMS - Cross-Site Scripting in Indexed Search
CWE-79
Medium · CVSS 5.1
EPSS 0.3%2026-06-09
TYPO3 CMS - Open Redirect in Core Utilities
CWE-601
Medium · CVSS 5.3
EPSS 0.3%2026-06-09
TYPO3 CMS - Broken Access Control in Form Framework
CWE-178
High · CVSS 7.6
EPSS 0.3%2026-06-09

Track new TYPO3 CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor TYPO3 CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

Symantec598 CVEs itsourcecode589 CVEs openclaw588 CVEs JetBrains580 CVEs Linux Foundation579 CVEs TP-Link570 CVEs zohocorp562 CVEs GNOME551 CVEs

Browse all vendors

Frequently asked questions

Common questions about TYPO3 vulnerabilities.

How many CVEs does TYPO3 have?: TYPO3 has 565 published CVE records since 2006, including 70 in the last two years.
How many TYPO3 CVEs are in CISA KEV?: None of TYPO3's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which TYPO3 products have the most CVEs?: The TYPO3 products with the most published CVEs are typo3, TYPO3.CMS, TYPO3 CMS, HTML Sanitizer, html-sanitizer.
What are the most common weakness types in TYPO3 CVEs?: TYPO3's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-862 (Missing Authorization), CWE-502 (Deserialization of Untrusted Data).
Are there public exploits for TYPO3 vulnerabilities?: Yes — 13 of TYPO3's CVEs have a known public exploit.
How many critical TYPO3 vulnerabilities are there?: TYPO3 has 22 critical and 221 high-severity CVEs.
What is the average severity of TYPO3 CVEs?: The average CVSS base score across TYPO3's scored CVEs is 6.2.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track TYPO3 vulnerabilities

Monitor new TYPO3 vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing