Skip to content
OpenAdvisories

Vendor

plone

12 known vulnerabilities.

Products

volto 3 plone.app.portlets 2 Products.isurlinportal 2 plone.app.textfield 1 plone.namedfile 1 plone.rest 1 plone.app.event 1 plone.app.dexterity 1 plone.app.contenttypes 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.9
    CVE-2026-57149

    plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection

    plone.app.portlets.portlets provides a Plone-specific user interface for plone.portlets, as well as a standard set of portlets that ship with Plone. Starting in version 5.0.0 and prior to versions 5.0.8, 6.0.4, and 7.0.2, the Classic portlet (plone.app.portle…

    plone plone.app.portlets plone-app-portlets PyPI
  • Critical 9.1
    CVE-2026-55247

    plone.app.event: Denial of service via iCalendar import

    plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ical/importer.py accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or…

    plone plone.app.event plone-app-event PyPI
  • Critical 9.1
    CVE-2026-55248

    plone.app.portlets: Denial of service via RSS feed portlet

    plone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets. Prior to 5.0.8, 6.0.4, and 7.0.2, a member who can add an RSS portlet can set its feed URL to a very large response, causing src/plone/app/portlets/portlets/rss.py to…

    plone plone.app.portlets plone-app-portlets PyPI