CVE-2026-8726

The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.

• CWE-89

• https://typo3.org/security/advisory/typo3-ext-sa-2026-010

Published

May 19, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8720wc_Blake2bHmacFinal and wc_Blake2sHmacFinal discard the mess…7.5
• CVE-2026-8721Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl trunca…9.8
• CVE-2026-8722Net::Async::Statsd::Client versions through 0.005 for Perl a…6.5
• CVE-2026-8723### Summary `qs.stringify` throws `TypeError` when called…6.3
• CVE-2026-8724A security flaw has been discovered in Dataease 2.10.20. Imp…7.2
• CVE-2026-8725A weakness has been identified in CoreWorxLab CAAL up to 1.6…7.3
• CVE-2026-8727The Crawler extension passes the X-T3Crawler-Meta response h…7.1
• CVE-2026-8728A security vulnerability has been detected in Open5GS up to …6.5
• CVE-2026-8729A vulnerability was detected in Open5GS up to 2.7.7. This af…6.5
• CVE-2026-8730A flaw has been found in Open5GS up to 2.7.6. This impacts t…6.5
• CVE-2026-8731A vulnerability has been found in Open5GS up to 2.7.7. Affec…6.5
• CVE-2026-8732The WP Maps Pro plugin for WordPress is vulnerable to Privil…9.8