CVE-2026-57149

The plone.app.portlets component is vulnerable to Remote Code Execution (RCE) via TALES injection in versions 5.0.0 through 5.0.7, 6.0.0 through 6.0.3, and 7.0.0 through 7.0.1. The root cause is that the Classic portlet (plone.app.portlets.portlets.classic) uses user-supplied template/macro field...

CVE-2026-57149 plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection

plone.app.portlets.portlets provides a Plone-specific user interface for plone.portlets, as well as a standard set of portlets that ship with Plone. Starting in version 5.0.0 and prior to versions 5.0.8, 6.0.4, and 7.0.2, the Classic portlet plone.app.portlets.portlets.classic used its...

PT-2026-55510

Name of the Vulnerable Software and Affected Versions plone.app.event versions prior to 5.2.4 plone.app.event versions prior to 6.0.1 Description The iCalendar import functionality in src/plone/app/event/ical/importer.py fails to sufficiently restrict calendar and event URLs, does not bound...

PT-2026-55511

Name of the Vulnerable Software and Affected Versions plone.app.portlets versions prior to 5.0.8 plone.app.portlets versions prior to 6.0.4 plone.app.portlets versions prior to 7.0.2 Description A member with permissions to add an RSS portlet can trigger a denial of service by setting the feed UR...

PT-2026-54521

Name of the Vulnerable Software and Affected Versions Plone versions 7.0.0 through 7.0.1 Plone versions 6.0.0 through 6.0.3 Plone versions 5.0.0 through 5.0.7 Description A critical remote code execution RCE flaw allows TALES injection via the Classic portlet. TALES is a templating language used ...

PT-2026-52218

Name of the Vulnerable Software and Affected Versions icalendar versions 7.1.0 through 7.1.2 Description The software contains a flaw in the Component equality method within src/icalendar/cal/component.py that leads to exponential time complexity O2^n relative to nesting depth when comparing nest...