CVE-2026-57149

plone.app.portlets.portlets provides a Plone-specific user interface for plone.portlets, as well as a standard set of portlets that ship with Plone. Starting in version 5.0.0 and prior to versions 5.0.8, 6.0.4, and 7.0.2, the Classic portlet plone.app.portlets.portlets.classic used its...

CVE-2026-57149 plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection

plone.app.portlets.portlets provides a Plone-specific user interface for plone.portlets, as well as a standard set of portlets that ship with Plone. Starting in version 5.0.0 and prior to versions 5.0.8, 6.0.4, and 7.0.2, the Classic portlet plone.app.portlets.portlets.classic used its...

PT-2026-55510

Name of the Vulnerable Software and Affected Versions plone.app.event versions prior to 5.2.4 plone.app.event versions prior to 6.0.1 Description The iCalendar import functionality in src/plone/app/event/ical/importer.py fails to sufficiently restrict calendar and event URLs, does not bound...

PT-2026-55511

Name of the Vulnerable Software and Affected Versions plone.app.portlets versions prior to 5.0.8 plone.app.portlets versions prior to 6.0.4 plone.app.portlets versions prior to 7.0.2 Description A member with permissions to add an RSS portlet can trigger a denial of service by setting the feed UR...

PT-2026-54521

Name of the Vulnerable Software and Affected Versions Plone versions 7.0.0 through 7.0.1 Plone versions 6.0.0 through 6.0.3 Plone versions 5.0.0 through 5.0.7 Description A critical remote code execution RCE flaw allows TALES injection via the Classic portlet. TALES is a templating language used ...

PT-2026-52218

Name of the Vulnerable Software and Affected Versions icalendar versions 7.1.0 through 7.1.2 Description The software contains a flaw in the Component equality method within src/icalendar/cal/component.py that leads to exponential time complexity O2^n relative to nesting depth when comparing nest...