Advisories · Technology

Typemill.

Every CVE that names Typemill among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-120218 CVE record

CVSS 5.1 Medium

Typemill SvgSanitizer.php saveImage cross site scripting
- Typemill
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 1 Nov 2026
CVE-2026-53468 CVE record

CVSS 4.6 Medium

Typemill has Stored HTML Attribute Injection in Metadata Fields
- typemill
- Cross-site scripting (XSS)
Not analysed yet 21 Aug 2026
CVE-2026-71518 CVE record

CVSS 8.7 High

Typemill < 2.26.0 Authorization Bypass via Media File Download Route
- typemill
- Broken access control
Not analysed yet 17 Aug 2026
CVE-2026-44401 CVE record

CVSS 4.6 Medium

Typemill CMS 2.x Persistent XSS via Markdown javascript URI
- Typemill
- Cross-site scripting (XSS)
Not analysed yet 10 Aug 2026
CVE-2026-71213 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

typemill - No Rate Limiting on Login Endpoint Enables Unlimited Password Brute-Force
- typemill
- Authentication bypass
Not analysed yet 5 Aug 2026
CVE-2026-49133 CVE record

CVSS 7.1 High

Typemill < 2.24.0 Path Traversal via ControllerApiImage::getPagemedia()
- typemill
- Path traversal
Not analysed yet 17 Jun 2026
CVE-2026-24127 CVE record

CVSS 5.4 Medium

Typemill has Reflected XSS via login error view template
- typemill
- Cross-site scripting (XSS)
- CWE-116
Not analysed yet 23 Jan 2026