TYPO3 News & Events Hub
What’s new & what’s comin’
TYPO3-EXT-SA-2026-036: Broken Access Control in extension "shop" (shop)
It has been discovered that the extension "TYPO3 Shop by coding.ms" (shop) is vulnerable to Broken Access Control.
Read moreTYPO3-EXT-SA-2026-035: Multiple vulnerabilities in extension "TYPO3 AI Integration Extension" (ns_t3ai)
It has been discovered that the extension “TYPO3 AI Integration Extension” (ns_t3ai) is vulnerable to Broken Access Control and Sensitive Data Exposure.
TYPO3-EXT-SA-2026-034: SQL Injection in extension "File manager" (ameos_filemanager)
It has been discovered that the extension "File manager" (ameos_filemanager) is vulnerable to SQL Injection.
TYPO3-EXT-SA-2026-033: Multiple vulnerabilities in extension "TYPO3 Fluid-Form" (fluid_form)
It has been discovered that the extension "TYPO3 Fluid-Form by coding.ms" (fluid_form) is vulnerable to Cross-Site Scripting and Broken Access Control.
TYPO3-EXT-SA-2026-032: Server-Side Request Forgery in extension "Kitodo.Presentation" (dlf)
It has been discovered that the extension "Kitodo.Presentation" (dlf) is vulnerable to Server-Side Request Forgery.
TYPO3-EXT-SA-2026-031: Multiple vulnerabilities in extension "Analytics" (analytics)
It has been discovered that the extension "Analytics" (analytics) is vulnerable to Insecure Direct Object Reference (IDOR) and Broken Access Control.
TYPO3-EXT-SA-2026-030: Captcha Bypass in extension "Accessible Form Captcha" (bw_captcha)
It has been discovered that the extension "Accessible Form Captcha" (bw_captcha) is vulnerable to Captcha Bypass.
TYPO3-EXT-SA-2026-029: Multiple vulnerabilities in extension "sgalinski Cookie Consent" (sg_cookie_optin)
It has been discovered that the extension "sgalinski Cookie Consent" (sg_cookie_optin) is vulnerable to SQL Injection and Missing Authorization.
TYPO3-EXT-SA-2026-028: Broken Access Control in extension "FAL Protect" (fal_protect)
It has been discovered that the extension "FAL Protect" (fal_protect) is vulnerable to Broken Access Control.
Beyond the Rim of the Plate: Notes From Kirby Konf 2026
On 25–26 September 2026, I spent two days in Mainz, Germany, at the first conference for the Kirby CMS. The crowd was mostly designers rather than developers, and their take on AI, sustainability, and community gave a developer like me plenty to think about.