plone vulnerabilities

CVEs per yearBy the year they were published

1. 20211
2. 20221
3. 20232
4. 20252
5. 20266

Newest CVEs

• CVE-2026-57576

  plone.app.dexterity and plone.app.contenttypes have a Denial of Service due to excessive title or description length

  plone · plone.app.dexterity

  Medium6.5
• CVE-2026-57149

  plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection

  plone · plone.app.portlets

  Critical9.9
• CVE-2026-54503

  plone.app.textfield: Stored XSS by spoofing mime type

  plone · plone.app.textfield

  Medium4.3
• CVE-2026-55247

  plone.app.event: Denial of service via iCalendar import

  plone · plone.app.event

  Critical9.1
• CVE-2026-55248

  plone.app.portlets: Denial of service via RSS feed portlet

  plone · plone.app.portlets

  Critical9.1
• CVE-2026-28413

  Products.isurlinportal: Possible open redirect when using more than 2 forward slashes

  plone · Products.isurlinportal

  Medium5.3
• CVE-2025-61668

  @plone/volto vulnerable to potential DoS by invoking specific URL by anonymous user

  plone · volto

  High8.7
• CVE-2025-58047

  Volto affected by possible DoS by invoking specific URL by anonymous user

  plone · volto

  High7.5
• CVE-2023-42457

  plone.rest vulnerable to Denial of Service when ++api++ is used many times

  plone · plone.rest

  High7.5
• CVE-2023-41048

  plone.namedfile vulnerable to Stored Cross Site Scripting with SVG images

  plone · plone.namedfile

  Low3.7