zopefoundation vulnerabilities

CVEs per yearBy the year they were published

1. 20217
2. 20236
3. 20243
4. 20251
5. 20263

Newest CVEs

• CVE-2026-77401

  Zope AccessControl: Information disclosure through Python string `format` and `format_map` functions

  zopefoundation · AccessControl

  Medium6.8
• CVE-2026-76825

  RestrictedPython: Sandbox escape via string.Formatter field resolution

  zopefoundation · RestrictedPython

  High8.4
• CVE-2026-55830

  RestrictedPython guard hooks can be shadowed via positional-only arguments

  zopefoundation · RestrictedPython

  High8.3
• CVE-2025-22153

  try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreter

  zopefoundation · RestrictedPython

  High7.9
• CVE-2024-51734

  User data deletion by anoynmous users in Zope

  zopefoundation · AccessControl

  High8.7
• CVE-2024-47532

  RestrictedPython information leakage via `AttributeError.obj` and the `string` module

  zopefoundation · RestrictedPython

  High8.7
• CVE-2024-24811

  Products.SQLAlchemyDA vulnerable to unauthenticated arbitrary SQL query execution

  zopefoundation · Products.SQLAlchemyDA

  Critical9.8
• CVE-2023-44389

  Zope management interface vulnerable to stored cross site scripting via the title property

  zopefoundation · Zope

  Low3.1
• CVE-2023-42458

  Zope vulnerable to Stored Cross Site Scripting with SVG images

  zopefoundation · Zope

  Low3.7
• CVE-2023-41050

  Information disclosure through Python's "format" functionality in Zope AccessControl

  zopefoundation · AccessControl

  Medium6.8