plone.app.portlets vulnerabilities

2 known vulnerabilities in plone.app.portlets from Plone. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.9 Critical severity

  plone.app.portlets: Improper Neutralization of Directives in Dynamically Evaluated Code

  CVE-2026-57149Sep 22, 2026Plone

  plone.app.portlets.portlets provides a Plone-specific user interface for plone.portlets, as well as a standard set of portlets that ship with Plone. Starting in version 5.0.0 and prior to versions 5.0.8, 6.0.4, and 7.0.2, the Classic portlet (plone.app.portlet

• 9.1 Critical severity

  plone.app.portlets: Uncontrolled Resource Consumption

  CVE-2026-55248Aug 28, 2026Plone

  plone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets. Prior to 5.0.8, 6.0.4, and 7.0.2, a member who can add an RSS portlet can set its feed URL to a very large response, causing src/plone/app/portlets/portlets/rss.py to