Critical
CVE-2026-57149
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 124
Reset filters
Medium
CVE-2026-57576
plone.app.dexterity has a Denial of Service due to excessive title or description length
Medium
ghsa-8pcw-h6w9-h46g
plone.app.contenttypes has a Denial of Service in File Upload due to excessive filename length
Critical
CVE-2026-55248
plone.app.portlets vulnerable to denial of service via RSS feed portlet
Critical
CVE-2026-55247
plone.app.event vulnerable to denial of service via iCalendar import
Critical
CVE-2026-54569
senaite.core Vulnerable to Eval Injection and Missing Authorization
Medium
CVE-2026-54503
plone.app.textfield: Stored XSS by spoofing mime type
Medium
ghsa-8rqh-vxpr-x77p
plone.restapi: Stored XSS by spoofing mime type
Medium
CVE-2024-22889
Phone information disclosure vulnerability
High
CVE-2024-0669
Cross-Frame Scripting vulnerability has been found on Plone CMS
High
CVE-2011-3587
Zope Command Execution Vulnerability
Medium
CVE-2011-1340
Plone XSS Vulnerability
High
CVE-2011-4030
Plone anonymous access to sub-objects in CMFEditions where KwAsAttributes classes were publishable
Medium
CVE-2008-4571
Plone Cross-site Scripting vulnerability in the LiveSearch module
Medium
CVE-2008-1396
Plone credentials stored in session cookie
High
CVE-2008-1393
Plone Improper Session Management
High
CVE-2008-1394
Plone CMS Improper Session Management
Medium
CVE-2006-1711
Plone allows remote users to modify arbitrary portraits
Medium
CVE-2026-28413
Products.isurlinportal has possible open redirect when using more than 2 forward slashes
Low
ghsa-hc5c-r8m5-2gfh
plone.restapi vulnerable to Stored Cross Site Scripting with SVG image in user portrait
Medium
CVE-2023-41048
plone.namedfile allows users to handle `File` and `Image` fields targeting, but not depending on, Plone Dexterity content. Prior to versions 5.6.1, 6.0.3, 6.1.3, and 6.2.1, there is a stored cross sit
High
CVE-2023-42457
plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the `++api++` traverser is accidentally
High
CVE-2023-41039
Sandbox escape via various forms of "format".
High
CVE-2023-37271
RestrictedPython vulnerable to arbitrary code execution via stack frame sandbox escape
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.