Plone

The plone.app.portlets package is vulnerable to denial of service, SSRF, and stored XSS via the RSS feed portlet feature, allowing authenticated users with portlet management permissions to exhaust memory, perform internal network reconnaissance, or inject malicious scripts.

The plone.app.event package contains multiple vulnerabilities including DoS, SSRF, and stored XSS within its iCalendar import functionality, potentially allowing a logged-in editor to compromise server availability and security.