CVE-2026-23946

Tendenci 15.3.11 and earlier contains a critical deserialization vulnerability in the Helpdesk module that enables authenticated RCE via Python pickle loads in helpdesk/reports/. While ticket_list() uses safe JSON deserialization, run_report() still relies on pickle.loads(), exposing impact limit...