Plone @plone/volto 14.0.0-alpha.5 < 15.0.0-alpha.0 Insecure Authentication

The version of the @plone/volto Node.js Package installed on the remote host is later than 14.0.0-alpha.5 prior to 15.0.0-alpha.0. It is, therefore, affected by an insecure authenticaiton vulnerability. A user could have their authentication cookie replaced with an authentication cookie from...

Denial-of-service (DoS)

@plone/volto is vulnerable to a denial-of-service DoS. The vulnerability is due to improper handling of a specific URL request, which allows an attacker to crash the NodeJS server component by simply visiting that crafted URL...

EUVD-2025-32021

Malicious code in bioql PyPI...

mysticcelestial (1.0.1) potentially affected by CVE-2025-61668 via @plone/volto (18.10.1)

@plone/volto NPM version 18.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on @plone/volto and may be impacted: - mysticcelestial 1.0.1 Source cves: CVE-2025-61668 Source advisory: SNYK:JS-PLONEVOLTO-13173379...

mysticcelestial (1.0.1) potentially affected by CVE-2025-61668 via @plone/volto (18.10.1)

@plone/volto NPM version 18.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on @plone/volto and may be impacted: - mysticcelestial 1.0.1 Source cves: CVE-2025-61668 Source advisory: OSV:GHSA-M8RJ-PPPH-MJ33...

Denial Of Service (DoS)

@plone/volto is vulnerable to Denial of Service DoS. The vulnerability is due to improper handling of specific URL requests which allows an attacker to crash the NodeJS server component and cause downtime...

mysticcelestial (1.0.1) potentially affected by CVE-2025-58047 via @plone/volto (18.10.1)

@plone/volto NPM version 18.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on @plone/volto and may be impacted: - mysticcelestial 1.0.1 Source cves: CVE-2025-58047 Source advisory: OSV:GHSA-XJHF-7833-3PM5...

mysticcelestial (1.0.1) potentially affected by CVE-2025-58047 via @plone/volto (18.10.1)

@plone/volto NPM version 18.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on @plone/volto and may be impacted: - mysticcelestial 1.0.1 Source cves: CVE-2025-58047 Source advisory: SNYK:JS-PLONEVOLTO-12239874...

Authentication Bypass

@plone/volto is vulnerable to authentication bypasses. A remote attacker is able to get attacker's authentication cookie replaced with the authentication cookie from another user, effectively giving the attacker full access to the victim's account and privileges...