Skip to content
Threat Feed
Subscribe

Vendor

Plone

3 briefs RSS
critical advisory

Remote Code Execution via TALES Injection in plone.app.portlets

Authenticated users can execute arbitrary code in the context of the Plone process by injecting malicious TALES expressions into Classic portlet configurations, exploitable via CVE-2026-57149.

plone.app.portlets +2 rce injection vulnerability web
1t 1c
medium advisory

Critical Vulnerabilities in plone.app.portlets RSS Feed Portlet

The plone.app.portlets package is vulnerable to denial of service, SSRF, and stored XSS via the RSS feed portlet feature, allowing authenticated users with portlet management permissions to exhaust memory, perform internal network reconnaissance, or inject malicious scripts.

plone.app.portlets +2
1c
medium advisory

Critical Vulnerabilities in plone.app.event

The plone.app.event package contains multiple vulnerabilities including DoS, SSRF, and stored XSS within its iCalendar import functionality, potentially allowing a logged-in editor to compromise server availability and security.

plone.app.event +1
1t 1c