CVE-2024-22889-Plone-v6.0.9

Product: Plone CMS Version: v6.0.9 Date found: 10.01.2024. Date reported: 10.01.2024. Vulnerability type: Incorrect Access Control. CVE ID: CVE-2024-22889 Description: Due to incorect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via...

Plone Docker - Host Header Injection

Plone Docker Official Image 5.2.13 5221 is vulnerable to Host Header Injection due to improper validation of input by the HOST headers. This can lead to Cross-Site Scripting XSS attacks when the malicious Host header value is reflected in the response. id: CVE-2024-23055 info: name: Plone Docker ...

plown

Informazioni Plown è uno scanner di sicurezza per il CMS Plone. Sebbene Plone abbia il miglior storico di sicurezza tra i principali CMS e sia considerato altamente sicuro, configurazioni errate e password deboli potrebbero consentire intrusioni nel sistema. Plown è stato sviluppato per facilitar...

plone-app-z3cform (>=4.0.0a1, <=4.0.0a10) potentially affected by CVE-2026-57576 via plone-app-dexterity (2.5.2)

plone-app-dexterity PYPI version 2.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on plone-app-dexterity and may be impacted: - plone-app-z3cform =4.0.0a1, =4.0.0a10 Source cves: CVE-2026-57576 Source advisory: OSV:PYSEC-2026-4137...

plone-app-layout (>=4.0.0a1, <=4.0.0a4) potentially affected by CVE-2026-57149 via plone-app-portlets (5.0.2)

plone-app-portlets PYPI version 5.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on plone-app-portlets and may be impacted: - plone-app-layout =4.0.0a1, =4.0.0a4 Source cves: CVE-2026-57149 Source advisory: OSV:PYSEC-2026-4138...

PT-2026-105886

Impact When creating content with a very large title or description field, Plone can become unresponsive. Even if the content loads, it can be hard to edit or delete, because the UI is unwieldy. Patches The problem has been patched in plone.app.dexterity. On Plone 6.2, upgrade to...

plone-app-z3cform (>=4.0.0a1, <=4.0.0a10) potentially affected by CVE-2026-57576 via plone-app-contenttypes (2.2.2)

plone-app-contenttypes PYPI version 2.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on plone-app-contenttypes and may be impacted: - plone-app-z3cform =4.0.0a1, =4.0.0a10 Source cves: CVE-2026-57576 Source advisory: OSV:GHSA-8PCW-H6W9-H46G...

GHSA-8PCW-H6W9-H46G plone.app.contenttypes has a Denial of Service in File Upload due to excessive filename length

Impact When creating an Image or File with a very large filename, Plone can become unresponsive. Even if the content loads, it can be hard to edit or delete, because the UI is unwieldy. Patches The problem has been patched in plone.app.contenttypes. On Plone 6.2, upgrade to plone.app.contenttypes...

EUVD-2026-84980

plone.app.dexterity has a Denial of Service due to excessive title or description length...

plone.app.dexterity has a Denial of Service due to excessive title or description length

Impact When creating content with a very large title or description field, Plone can become unresponsive. Even if the content loads, it can be hard to edit or delete, because the UI is unwieldy. Patches The problem has been patched in plone.app.dexterity. On Plone 6.2, upgrade to...

plone-app-z3cform (>=4.0.0a1, <=4.0.0a10) potentially affected by CVE-2026-57576 via plone-app-dexterity (2.5.2)

plone-app-dexterity PYPI version 2.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on plone-app-dexterity and may be impacted: - plone-app-z3cform =4.0.0a1, =4.0.0a10 Source cves: CVE-2026-57576 Source advisory: OSV:GHSA-5426-92W4-WVHV...

plone-app-layout (>=4.0.0a1, <=4.0.0a4) potentially affected by CVE-2026-57149 via plone-app-portlets (5.0.2)

plone-app-portlets PYPI version 5.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on plone-app-portlets and may be impacted: - plone-app-layout =4.0.0a1, =4.0.0a4 Source cves: CVE-2026-57149 Source advisory: OSV:GHSA-RR49-F9G6-C9R5...

CVE-2026-57576

plone.app.dexterity is a content-type system for the Plone content management system, and plone.app.contenttypes provides Plone’s Dexterity-based content types. Plone.app.dexterity versions through 3.2.2, 4.0.0 through 4.1.2, and 5.0.0, and plone.app.contenttypes versions through 3.0.11, 4.0.0...

plone-app-contenttypes (>=3.0.0a1, <=3.0.0b2) potentially affected by CVE-2026-55247 via plone-app-event (4.0.0)

plone-app-event PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on plone-app-event and may be impacted: - plone-app-contenttypes =3.0.0a1, =3.0.0b2 Source cves: CVE-2026-55247 Source advisory: OSV:PYSEC-2026-3883...

plone-app-z3cform (>=4.0.0a1, <=4.0.0a10) potentially affected by CVE-2026-55248 via plone-app-portlets (4.4.0)

plone-app-portlets PYPI version 4.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on plone-app-portlets and may be impacted: - plone-app-z3cform =4.0.0a1, =4.0.0a10 Source cves: CVE-2026-55248 Source advisory: OSV:PYSEC-2026-3884...

plone.app.event vulnerable to denial of service via iCalendar import

ImpactBy abusing the iCalendar import functionality, a logged-in editor could take the whole site offline, make the server reach into the internal network and read calendar files off disk SSRF, and store XSS. PatchesThe problem has been patched in plone.app.event. For Plone 6.2: upgrade to...

plone-app-z3cform (>=4.0.0a1, <=4.0.0a10) potentially affected by CVE-2026-55247 via plone-app-event (4.0.0a9)

plone-app-event PYPI version 4.0.0a9 is affected by a known vulnerability. The following packages have a transitive dependency on plone-app-event and may be impacted: - plone-app-z3cform =4.0.0a1, =4.0.0a10 Source cves: CVE-2026-55247 Source advisory: OSV:PYSEC-2026-3883...

plone-app-portlets (>=5.0.0a3, <=5.0.0a4) potentially affected by CVE-2026-55247 via plone-app-event (3.2.1)

plone-app-event PYPI version 3.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on plone-app-event and may be impacted: - plone-app-portlets =5.0.0a3, =5.0.0a4 Source cves: CVE-2026-55247 Source advisory: OSV:PYSEC-2026-3883...

plone-app-layout (>=4.0.0a1, <=4.0.0a4) potentially affected by CVE-2026-55248 via plone-app-portlets (5.0.2)

plone-app-portlets PYPI version 5.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on plone-app-portlets and may be impacted: - plone-app-layout =4.0.0a1, =4.0.0a4 Source cves: CVE-2026-55248 Source advisory: OSV:PYSEC-2026-3884...

plone.app.event vulnerable to denial of service via iCalendar import

Impact By abusing the iCalendar import functionality, a logged-in editor could take the whole site offline, make the server reach into the internal network and read calendar files off disk SSRF, and store XSS. Patches The problem has been patched in plone.app.event. For Plone 6.2: upgrade to...