Is typo3/cms-core 8.7 vulnerable?

Composer · 26 releases from 8.7.7 to 8.7.32 · latest typo3/cms-core is 14.3.10 · checked 2 Nov 2026

Yes: 33 known advisories

Yes. typo3/cms-core 8.7.32, the last 8.7 release, is affected by 33 known security advisories (8 high, 24 medium, 1 low), including CVE-2026-11607, CVE-2026-47343, CVE-2026-47346. 33 more affect earlier 8.7.x releases. Upgrade to 10.4.57 or later to fix all of them.

Upgrade with:composer require typo3/cms-core:^10.4.57

Advisories affecting typo3/cms-core 8.7.32

HighCVE-2026-11607GHSA-pjpj-v387-x4vq12 Jun 2026
TYPO3 CMS has Broken Access Control in its Form Framework
Affected
<10.4.57 · >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
Fixed in
10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
MediumCVE-2026-47349GHSA-f34x-rx2w-7pm312 Jun 2026
TYPO3 CMS has Broken Access Control in the Recycler Module
Affected
<10.4.57 · >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
Fixed in
10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
MediumCVE-2026-47347GHSA-3p42-w5ch-gg4212 Jun 2026
TYPO3 CMS has an Open Redirect Vulnerability via Core Utilities
Affected
<10.4.57 · >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
Fixed in
10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
HighCVE-2026-47343GHSA-3v8v-4wg6-r7qh12 Jun 2026
TYPO3 CMS: Destructive Actions on File Mount Folders
Affected
<10.4.57 · >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
Fixed in
10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
HighCVE-2026-47346GHSA-hwvq-2w67-rvxp12 Jun 2026
TYPO3 CMS has Broken Access Control in its Form Framework
Affected
<10.4.57 · >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
Fixed in
10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
MediumCVE-2026-49740GHSA-c78m-c52x-jgwp12 Jun 2026
TYPO3 CMS has Insecure Deserialization via Core API
Affected
<10.4.57 · >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
Fixed in
10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
LowCVE-2026-49738GHSA-jf56-v8jc-jcc512 Jun 2026
TYPO3 CMS has Broken Access Control in its File Abstraction Layer
Affected
<10.4.57 · >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
Fixed in
10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
MediumCVE-2026-47352GHSA-2j54-93q2-3hjq12 Jun 2026
TYPO3 CMS has Broken Access Control in Backend API
Affected
<10.4.57 · >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
Fixed in
10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
MediumCVE-2026-47351GHSA-q93m-25xv-94hh12 Jun 2026
TYPO3 CMS: Broken Access Control in Media Module
Affected
<10.4.57 · >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
Fixed in
10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
HighCVE-2024-22188GHSA-5w2h-59j3-8x5w13 Feb 2024
TYPO3 Install Tool vulnerable to Code Execution
Affected
>=8.0.0 <8.7.57 · >=9.0.0 <9.5.46 · >=10.0.0 <10.4.43 · >=11.0.0 <11.5.35 · >=12.0.0 <12.4.11 · >=13.0.0 <13.0.1
Fixed in
8.7.57, 9.5.46, 10.4.43, 11.5.35, 12.4.11, 13.0.1
MediumCVE-2023-30451GHSA-w6x2-jg8h-p6mp13 Feb 2024
Path Traversal in TYPO3 File Abstraction Layer Storages
Affected
>=8.0.0 <8.7.57 · >=9.0.0 <9.5.46 · >=10.0.0 <10.4.43 · >=11.0.0 <11.5.35 · >=12.0.0 <12.4.11 · >=13.0.0 <13.0.1
Fixed in
8.7.57, 9.5.46, 10.4.43, 11.5.35, 12.4.11, 13.0.1
HighCVE-2024-25121GHSA-rj3x-wvc6-5j6613 Feb 2024
TYPO3 vulnerable to Improper Access Control Persisting File Abstraction Layer Entities via Data Handler
Affected
>=8.0.0 <8.7.57 · >=9.0.0 <9.5.46 · >=10.0.0 <10.4.43 · >=11.0.0 <11.5.35 · >=12.0.0 <12.4.11 · >=13.0.0 <13.0.1
Fixed in
8.7.57, 9.5.46, 10.4.43, 11.5.35, 12.4.11, 13.0.1
MediumCVE-2024-25120GHSA-wf85-8hx9-gj7c13 Feb 2024
TYPO3 vulnerable to Improper Access Control of Resources Referenced by t3:// URI Scheme
Affected
>=8.0.0 <8.7.57 · >=9.0.0 <9.5.46 · >=10.0.0 <10.4.43 · >=11.0.0 <11.5.35 · >=12.0.0 <12.4.11 · >=13.0.0 <13.0.1
Fixed in
8.7.57, 9.5.46, 10.4.43, 11.5.35, 12.4.11, 13.0.1
MediumCVE-2024-25119GHSA-h47m-3f78-qp9g13 Feb 2024
TYPO3 Install Tool vulnerable to Information Disclosure of Encryption Key
Affected
>=8.0.0 <8.7.57 · >=9.0.0 <9.5.46 · >=10.0.0 <10.4.43 · >=11.0.0 <11.5.35 · >=12.0.0 <12.4.11 · >=13.0.0 <13.0.1
Fixed in
8.7.57, 9.5.46, 10.4.43, 11.5.35, 12.4.11, 13.0.1
MediumCVE-2024-25118GHSA-38r2-5695-334w13 Feb 2024
TYPO3 Backend Forms vulnerable to Information Disclosure of Hashed Passwords
Affected
>=8.0.0 <8.7.57 · >=9.0.0 <9.5.46 · >=10.0.0 <10.4.43 · >=11.0.0 <11.5.35 · >=12.0.0 <12.4.11 · >=13.0.0 <13.0.1
Fixed in
8.7.57, 9.5.46, 10.4.43, 11.5.35, 12.4.11, 13.0.1
MediumCVE-2023-47127GHSA-3vmm-7h4j-69rm14 Nov 2023
TYPO3 vulnerable to Weak Authentication in Session Handling
Affected
>=8.0.0 <8.7.55 · >=9.0.0 <9.5.44 · >=10.0.0 <10.4.41 · >=11.0.0 <11.5.33 · >=12.0.0 <12.4.8
Fixed in
8.7.55, 9.5.44, 10.4.41, 11.5.33, 12.4.8
HighCVE-2023-24814GHSA-r4f8-f93x-5qh38 Feb 2023
TYPO3 is vulnerable to Cross-Site Scripting via frontend rendering
Affected
>=12.0.0 <12.2.0 · >=11.0.0 <11.5.23 · >=10.0.0 <10.4.36 · >=9.0.0 <9.5.40 · >=8.7.0 <8.7.51
Fixed in
8.7.51, 9.5.40, 10.4.36, 11.5.23, 12.2.0
HighCVE-2022-23503GHSA-c5wx-6c2c-f7rm13 Dec 2022
TYPO3 CMS vulnerable to Arbitrary Code Execution via Form Framework
Affected
>=8.0.0 <8.7.49 · >=9.0.0 <9.5.38 · >=10.0.0 <10.4.33 · >=11.0.0 <11.5.20 · >=12.0.0 <12.1.1
Fixed in
8.7.49, 9.5.38, 10.4.33, 11.5.20, 12.1.1
MediumCVE-2022-23501GHSA-jfp7-79g7-89rf13 Dec 2022
TYPO3 CMS vulnerable to Weak Authentication in Frontend Login
Affected
<8.7.49 · >=9.0.0 <9.5.38 · >=10.0.0 <10.4.33 · >=11.0.0 <11.5.20 · >=12.0.0 <12.1.1
Fixed in
8.7.49, 9.5.38, 10.4.33, 11.5.20, 12.1.1
MediumCVE-2022-36105GHSA-m392-235j-9r7r16 Sept 2022
TYPO3 CMS vulnerable to User Enumeration via Response Timing
Affected
>=7.0.0 <7.6.58 · >=8.0.0 <8.7.48 · >=9.0.0 <9.5.37 · >=10.0.0 <10.4.32 · >=11.0.0 <11.5.16
Fixed in
7.6.58, 8.7.48, 9.5.37, 10.4.32, 11.5.16
MediumCVE-2022-36107GHSA-9c6w-55cp-5w2516 Sept 2022
TYPO3 CMS Stored Cross-Site Scripting via FileDumpController
Affected
>=7.0.0 <7.6.58 · >=8.0.0 <8.7.48 · >=9.0.0 <9.5.37 · >=10.0.0 <10.4.32 · >=11.0.0 <11.5.16
Fixed in
7.6.58, 8.7.48, 9.5.37, 10.4.32, 11.5.16
MediumGHSA-gqqf-g5r7-84vf15 Sept 2022
TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting Protection
Affected
>=7.0.0 <7.6.58 · >=8.0.0 <8.7.48 · >=9.0.0 <9.5.37 · >=10.0.0 <10.4.32 · >=11.0.0 <11.5.16
Fixed in
7.6.58, 8.7.48, 9.5.37, 10.4.32, 11.5.16
MediumCVE-2022-31048GHSA-3r95-23jp-mhvg17 Jun 2022
Cross-Site Scripting in TYPO3's Form Framework
Affected
>=8.0.0 <8.7.47 · >=9.0.0 <9.5.35 · >=10.0.0 <10.4.29 · >=11.0.0 <11.5.11
Fixed in
8.7.47, 9.5.35, 10.4.29, 11.5.11
MediumCVE-2022-31047GHSA-fh99-4pgr-8j9917 Jun 2022
Insertion of Sensitive Information into Log File in typo3/cms-core
Affected
>=7.0.0 <7.6.57 · >=8.0.0 <8.7.47 · >=9.0.0 <9.5.35 · >=10.0.0 <10.4.29 · >=11.0.0 <11.5.11
Fixed in
7.6.57, 8.7.47, 9.5.35, 10.4.29, 11.5.11
MediumCVE-2022-31046GHSA-8gmv-9hwg-w89g17 Jun 2022
Information Disclosure via Export Module
Affected
>=7.0.0 <7.6.57 · >=8.0.0 <8.7.47 · >=9.0.0 <9.5.35 · >=10.0.0 <10.4.29 · >=11.0.0 <11.5.11
Fixed in
7.6.57, 8.7.47, 9.5.35, 10.4.29, 11.5.11
MediumCVE-2021-32768GHSA-c5c9-8c6m-727v19 Aug 2021
Cross-Site Scripting via Rich-Text Content
Affected
>=7.0.0 <7.6.53 · >=8.0.0 <8.7.42 · >=10.0.0 <10.4.19 · >=11.0.0 <11.3.2 · >=9.0.0 <9.5.29
Fixed in
7.6.53, 8.7.42, 9.5.29, 10.4.19, 11.3.2
MediumCVE-2021-32767GHSA-34fr-fhqr-723526 Jul 2021
Information Disclosure in User Authentication
Affected
>=7.0.0 <7.6.52 · >=8.0.0 <8.7.41 · >=9.0.0 <9.5.28 · >=10.0.0 <10.4.18 · >=11.0.0 <11.3.1
Fixed in
7.6.52, 8.7.41, 9.5.28, 10.4.18, 11.3.1
MediumCVE-2021-32669GHSA-rgcg-28xm-8mmw22 Jul 2021
Cross-Site Scripting in Backend Grid View
Affected
>=8.0.0 <8.7.41 · >=9.0.0 <9.5.28 · >=10.0.0 <10.4.18 · >=11.0.0 <11.3.1
Fixed in
8.7.41, 9.5.28, 10.4.18, 11.3.1
MediumCVE-2021-32668GHSA-6mh3-j5r5-237922 Jul 2021
Cross-Site Scripting in Query Generator & Query View
Affected
>=8.0.0 <8.7.41 · >=9.0.0 <9.5.28 · >=10.0.0 <10.4.18 · >=11.0.0 <11.3.1
Fixed in
8.7.41, 9.5.28, 10.4.18, 11.3.1
MediumCVE-2021-21339GHSA-qx3w-4864-94ch23 Mar 2021
Cleartext storage of session identifier
Affected
>=6.2.0 <6.2.57 · >=7.0.0 <7.6.51 · >=8.0.0 <8.7.40 · >=10.0.0 <10.4.14 · >=11.0.0 <11.1.1 · >=9.0.0 <9.5.25
Fixed in
6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1
MediumCVE-2021-21338GHSA-4jhw-2p6j-5wmp23 Mar 2021
Open Redirection in Login Handling
Affected
>=6.2.0 <6.2.57 · >=7.0.0 <7.6.51 · >=8.0.0 <8.7.40 · >=10.0.0 <10.4.14 · >=11.0.0 <11.1.1 · >=9.0.0 <9.5.25
Fixed in
6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1
MediumCVE-2020-26227GHSA-vqqx-jw6p-q3rf21 Dec 2020
Cross-Site Scripting in Fluid view helpers
Affected
>=9.0.0 <9.5.23 · >=10.0.0 <10.4.10 · >=8.7.0 <8.7.38
Fixed in
8.7.38, 9.5.23, 10.4.10
HighCVE-2020-26228GHSA-954j-f27r-cj5223 Nov 2020
Cleartext storage of session identifier
Affected
>=9.0.0 <9.5.23 · >=10.0.0 <10.4.10 · >=8.7.0 <8.7.38
Fixed in
8.7.38, 9.5.23, 10.4.10

Fixed within 8.7.x, affecting earlier releases

HighGHSA-5h5v-m596-r6rf30 May 2024
TYPO3 Possible Insecure Deserialization in Extbase Request Handling
Affected
>=8.0.0 <8.7.30 · >=9.0.0 <9.5.12
Fixed in
8.7.30, 9.5.12
MediumGHSA-6xwf-7rfm-4gwc30 May 2024
TYPO3 Cross-Site Scripting in Filelist Module
Affected
>=10.0.0 <10.2.1 · >=8.0.0 <8.7.30 · >=9.0.0 <9.5.12
Fixed in
8.7.30, 9.5.12, 10.2.1
MediumGHSA-4ppr-jw47-9qm530 May 2024
TYPO3 Cross-Site Scripting in Link Handling
Affected
>=10.0.0 <10.2.1 · >=8.0.0 <8.7.30 · >=9.0.0 <9.5.12
Fixed in
8.7.30, 9.5.12, 10.2.1
MediumGHSA-95qm-3xp7-vfj530 May 2024
TYPO3 Cross-Site Scripting in Form Framework validation handling
Affected
>=10.0.0 <10.2.1 · >=8.0.0 <8.7.30 · >=9.0.0 <9.5.12
Fixed in
8.7.30, 9.5.12, 10.2.1
HighGHSA-x428-565f-8xj230 May 2024
TYPO3 Arbitrary Code Execution and Cross-Site Scripting in Backend API
Affected
>=8.0.0 <8.7.27 · >=9.0.0 <9.5.8
Fixed in
8.7.27, 9.5.8
HighGHSA-82vp-jr39-4j2j30 May 2024
TYPO3 Security Misconfiguration in Frontend Session Handling
Affected
>=8.0.0 <8.7.27 · >=9.0.0 <9.5.8
Fixed in
8.7.27, 9.5.8
MediumGHSA-rv8r-8mh5-537630 May 2024
TYPO3 Information Disclosure in Backend User Interface
Affected
>=8.0.0 <8.7.27 · >=9.0.0 <9.5.8
Fixed in
8.7.27, 9.5.8
MediumGHSA-p2h4-7fp3-cmh830 May 2024
TYPO3 Disclosure of Information about Installed Extensions
Affected
>=8.0.0 <8.7.23 · >=9.0.0 <9.5.4
Fixed in
8.7.23, 9.5.4
MediumGHSA-xmgr-jff3-fcfv30 May 2024
TYPO3 Security Misconfiguration in User Session Handling
Affected
>=8.0.0 <8.7.25 · >=9.0.0 <9.5.6
Fixed in
8.7.25, 9.5.6
MediumGHSA-4459-qrcc-vfcf30 May 2024
TYPO3 Cross-Site Scripting in Form Framework
Affected
>=8.5.0 <8.7.23 · >=9.0.0 <9.5.4
Fixed in
8.7.23, 9.5.4
HighGHSA-f9hr-7cfq-mjg230 May 2024
TYPO3 Arbitrary Code Execution via File List Module
Affected
>=8.0.0 <8.7.23 · >=9.0.0 <9.5.4
Fixed in
8.7.23, 9.5.4
MediumGHSA-9rx9-7fmh-gj3g30 May 2024
TYPO3 Broken Access Control in Localization Handling
Affected
>=8.0.0 <8.7.23
Fixed in
8.7.23
HighGHSA-rxc9-f2x6-qh4w30 May 2024
TYPO3 Security Misconfiguration for Backend User Accounts
Affected
>=8.0.0 <8.7.23 · >=9.0.0 <9.5.4
Fixed in
8.7.23, 9.5.4
HighGHSA-hjx5-v9xg-7h2530 May 2024
TYPO3 Denial of Service in Frontend Record Registration
Affected
>=8.0.0 <8.7.21 · >=7.0.0 <7.6.32
Fixed in
7.6.32, 8.7.21
MediumGHSA-29m4-mx89-3mjg30 May 2024
TYPO3 Denial of Service in Online Media Asset Handling
Affected
>=8.0.0 <8.7.21 · >=9.0.0 <9.5.2 · >=7.0.0 <7.6.32
Fixed in
7.6.32, 8.7.21, 9.5.2
MediumGHSA-66c2-7g4p-wx4p30 May 2024
TYPO3 Information Disclosure in Install Tool
Affected
>=8.0.0 <8.7.21 · >=9.0.0 <9.5.2 · >=7.0.0 <7.6.32
Fixed in
7.6.32, 8.7.21, 9.5.2
HighGHSA-ppvg-hw62-6ph930 May 2024
TYPO3 Security Misconfiguration in Install Tool Cookie
Affected
>=8.0.0 <8.7.21 · >=9.0.0 <9.5.2 · >=7.0.0 <7.6.32
Fixed in
7.6.32, 8.7.21, 9.5.2
MediumGHSA-8c25-vj2w-p72j30 May 2024
TYPO3 Cross-Site Scripting in Frontend User Login
Affected
>=8.0.0 <8.7.21 · >=9.0.0 <9.5.2 · >=7.1.0 <7.6.32
Fixed in
7.6.32, 8.7.21, 9.5.2
MediumGHSA-g4c9-qfvw-fmr430 May 2024
TYPO3 Cross-Site Scripting in Backend Modal Component
Affected
>=8.0.0 <8.7.21 · >=9.0.0 <9.5.2 · >=7.1.0 <7.6.32
Fixed in
7.6.32, 8.7.21, 9.5.2
HighGHSA-96jg-pmc4-cx3930 May 2024
TYPO3 CMS Insecure Deserialization
Affected
>=8.5.0 <8.7.17 · >=9.0.0 <9.3.1
Fixed in
8.7.17, 9.3.1
MediumGHSA-wg8h-gxf4-g4gh30 May 2024
TYPO3 Cross-Site Scripting in Online Media Asset Rendering
Affected
>=8.0.0 <8.7.21 · >=9.0.0 <9.5.2
Fixed in
8.7.21, 9.5.2
HighGHSA-45wj-jv2h-jwrf30 May 2024
TYPO3 CMS Privilege Escalation and SQL Injection
Affected
>=8.5.0 <8.7.17 · >=9.0.0 <9.3.2
Fixed in
8.7.17, 9.3.2
CriticalGHSA-cc97-g92w-jm6530 May 2024
TYPO3 CMS Insecure Deserialization & Arbitrary Code Execution
Affected
>=8.0.0 <8.7.17 · >=9.0.0 <9.3.2 · >=7.0.0 <7.6.30
Fixed in
7.6.30, 8.7.17, 9.3.2
HighGHSA-x4rj-f7m6-42c330 May 2024
TYPO3 CMS Authentication Bypass vulnerability
Affected
>=8.0.0 <8.7.17 · >=9.0.0 <9.3.2 · >=7.0.0 <7.6.30
Fixed in
7.6.30, 8.7.17, 9.3.2
HighCVE-2019-12747GHSA-86hp-xrhj-fhpq24 May 2022
TYPO3 Vulnerable to Insecure Deserialization
Affected
>=8.0.0 <8.7.27 · >=9.0.0 <9.5.8
Fixed in
8.7.27, 9.5.8
MediumCVE-2019-12748GHSA-r6fv-56gp-j3r424 May 2022
Typo3 Cross-Site Scripting in Link Handling
Affected
>=8.0.0 <8.7.27 · >=9.0.0 <9.5.8
Fixed in
8.7.27, 9.5.8
HighCVE-2019-11832GHSA-3w4h-r27h-4r2w24 May 2022
TYPO3 Image Processing susceptible to Code Execution
Affected
>=8.0.0 <8.7.25 · >=9.0.0 <9.5.6
Fixed in
8.7.25, 9.5.6
MediumCVE-2019-19850GHSA-59pj-7mjh-446524 May 2022
TYPO3 SQL Injection in low-level Query Generator
Affected
>=8.0 <8.7.30 · >=9.0 <9.5.12 · >=10.0 <10.2.2
Fixed in
8.7.30, 9.5.12, 10.2.2
HighCVE-2019-19849GHSA-rcgc-4xfc-564v24 May 2022
TYPO3 Insecure Deserialization in Query Generator & Query View
Affected
>=10.0.0 <10.2.1 · >=8.0.0 <8.7.30 · >=9.0.0 <9.5.12
Fixed in
8.7.30, 9.5.12, 10.2.1
MediumCVE-2019-19848GHSA-77p4-wfr8-977w24 May 2022
TYPO3 Directory Traversal on ZIP extraction
Affected
>=10.0.0 <10.2.2 · >=8.0.0 <8.7.30 · >=9.0.0 <9.5.12
Fixed in
8.7.30, 9.5.12, 10.2.2
MediumCVE-2020-15241GHSA-7733-hjv6-4h478 Oct 2020
Cross-Site Scripting in ternary conditional operator
Affected
>=8.0.0 <8.7.25 · >=9.0.0 <9.5.6
Fixed in
8.7.25, 9.5.6
MediumCVE-2018-17960GHSA-g68x-vvqq-pvw321 Nov 2018
Ckeditor XSS Vulnerability
Affected
>=8.0.0 <8.7.21 · >=9.0.0 <9.5.2
Fixed in
8.7.21, 9.5.2
MediumCVE-2018-14041GHSA-pj7m-g53m-763813 Sept 2018
Bootstrap Cross-site Scripting vulnerability
Affected
>=8.0.0 <8.7.23 · >=9.0.0 <9.5.4
Fixed in
8.7.23, 9.5.4

Which of your client projects are still on typo3/cms-core 8.7?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact typo3/cms-core version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

Other typo3/cms-core versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.