Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-113459 | not reported | — | No | In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can conta... | 2026-10-20 |
| CVE-2026-113442 | not reported | — | No | Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inje... | 2026-10-20 |
| CVE-2026-112240 | not reported | — | No | The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not ver... | 2026-10-20 |
| CVE-2026-112239 | not reported | — | No | The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks... | 2026-10-20 |
| CVE-2026-112238 | not reported | — | No | The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters o... | 2026-10-20 |
| CVE-2026-112237 | not reported | — | No | The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does n... | 2026-10-20 |
| CVE-2026-112071 | not reported | — | No | The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it... | 2026-10-20 |
| CVE-2026-112070 | not reported | — | No | The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user... | 2026-10-20 |
| CVE-2026-112069 | not reported | — | No | The extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were... | 2026-10-20 |
| CVE-2026-112068 | not reported | — | No | The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore ope... | 2026-10-20 |
| CVE-2026-112067 | not reported | — | No | The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can request a CAPTCHA image c... | 2026-10-20 |
| CVE-2026-112066 | not reported | — | No | The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to t... | 2026-10-20 |
| CVE-2026-112065 | not reported | — | No | The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the reques... | 2026-10-20 |
| CVE-2026-112064 | not reported | — | No | The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a databa... | 2026-10-20 |
| CVE-2026-11960 | not reported | — | No | Enumeration of unauthenticated users in FacturaScripts, version 2025.61. The application returns different responses when attempting to log... | 2026-10-20 |
| CVE-2026-11959 | not reported | — | No | Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input... | 2026-10-20 |
| CVE-2026-113407 | high | 8.8 | No | BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements t... | 2026-10-20 |
| CVE-2026-113404 | high | 8.8 | No | WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard-coded cryptographic... | 2026-10-20 |
| CVE-2026-113403 | medium | 6.5 | No | ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability. Authenticated remote attackers can inject crafted c... | 2026-10-20 |
| CVE-2026-113402 | medium | 6.5 | No | ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attackers can exploit path... | 2026-10-20 |