CPE
critical
advisory
Remote Code Execution via TALES Injection in plone.app.portlets
1 TTP 1 CVEAuthenticated users can execute arbitrary code in the context of the Plone process by injecting malicious TALES expressions into Classic portlet configurations, exploitable via CVE-2026-57149.
plone.app.portlets +2
rce
injection
vulnerability
web
1t
1c
medium
advisory
Critical Vulnerabilities in plone.app.portlets RSS Feed Portlet
1 CVEThe plone.app.portlets package is vulnerable to denial of service, SSRF, and stored XSS via the RSS feed portlet feature, allowing authenticated users with portlet management permissions to exhaust memory, perform internal network reconnaissance, or inject malicious scripts.
plone.app.portlets +2
1c