TYPO3 Extension Event Management And Registration vulnerabilities

2 CVEs affecting TYPO3 Extension Event Management And Registration, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-77129, published 2026-08-25.

More from TYPO3.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-77128, published 2026-08-25. Medium severity, CVSS 6.3. EPSS: 0.5% chance of exploitation in the next 30 days. The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events,…
• CVE-2026-77129, published 2026-08-25. High severity, CVSS 7.7. EPSS: 0.4% chance of exploitation in the next 30 days. The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction. A backend user with edit access to the event plugin or Backend Module can…