Vulnerabilities

TI-2026-53992 CVE-2026-77401 · GHSA-pq59-9fq7-m886

Zope AccessControl: Information disclosure through Python string `format` and `format_map` functions

LOW 30

Zope AccessControl provides a general security framework for use in Zope.

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00469 Published 2026-09-16 Fixed in 7.4 CWE-693

TI-2026-53666 CVE-2026-76825 · GHSA-hp3v-5vw7-fx9w

RestrictedPython: Sandbox escape via string.Formatter field resolution

LOW 39

RestrictedPython is a tool that helps define a subset of the Python language for accepting program input in a trusted environment.

CVSS 3.1HIGH 8.4 Network High privileges User interaction EPSS 0.00624 Published 2026-09-16 Fixed in 8.4 CWE-200

TI-2026-40297 CVE-2026-55830 · GHSA-ffg3-p8fm-mjx2

RestrictedPython guard hooks can be shadowed via positional-only arguments

HIGH 71

RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment.

CVSS 3.1HIGH 8.3 Network High privileges User interaction EPSS 0.00287 Published 2026-07-08 Fixed in 8.3 CWE-184

TI-2025-16099 CVE-2025-22153 · GHSA-gmj9-h825-chq2

try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreter

LOW 37

RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment.

CVSS 3.1HIGH 7.9 Network High privileges No interaction EPSS 0.004 Published 2025-01-23 Fixed in 8.0 CWE-843

TI-2024-34640 CVE-2024-51734 · GHSA-g5vw-3h65-2q3v

User data deletion by anoynmous users in Zope

MEDIUM 44

Zope AccessControl provides a general security framework for use in Zope.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00434 Published 2024-11-04 Fixed in 7.2, 5.11.1 CWE-284

TI-2024-31821 CVE-2024-47532 · GHSA-5rfv-66g4-jr8h

RestrictedPython information leakage via `AttributeError.obj` and the `string` module

MEDIUM 45

RestrictedPython is a restricted execution environment for Python to run untrusted code.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00716 Published 2024-09-30 Fixed in 7.3 CWE-200

TI-2024-16328 CVE-2024-24811 · GHSA-r3jc-3qmm-w3pw

Products.SQLAlchemyDA vulnerable to unauthenticated arbitrary SQL query execution

MEDIUM 51

SQLAlchemyDA is a generic database adapter for ZSQL methods.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00889 Published 2024-02-07 Fixed in 2.2 CWE-89

TI-2023-23895 CVE-2023-44389 · GHSA-m755-gxxg-r5qh

Zope management interface vulnerable to stored cross site scripting via the title property

LOW 23

Zope is an open-source web application server.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00481 Published 2023-10-04 Fixed in 4.8.11, 5.8.6 CWE-79

TI-2023-22623 CVE-2023-42458 · GHSA-wm8q-9975-xh5v

Zope vulnerable to Stored Cross Site Scripting with SVG images

LOW 26

Zope is an open-source web application server.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00714 Published 2023-09-21 Fixed in 4.8.10, 5.8.5 CWE-79

TI-2023-21676 CVE-2023-41050 · GHSA-8xv7-89vj-q48c

Information disclosure through Python's "format" functionality in Zope AccessControl

LOW 35

AccessControl provides a general security framework for use in Zope.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00641 Published 2023-09-06 Fixed in 4.4, 4.8.9 +3 CWE-200

TI-2023-21665 CVE-2023-41039 · GHSA-xjw2-6jm9-rf67

Sandbox escape via various forms of "format" in RestrictedPython

LOW 39

RestrictedPython is a restricted execution environment for Python to run untrusted code.

CVSS 3.1HIGH 8.3 Network High privileges User interaction EPSS 0.00683 Published 2023-08-30 Fixed in 5.4, 6.1 +1 CWE-74

TI-2023-18901 CVE-2023-37271 · GHSA-wqc8-x2pr-7jqh

RestrictedPython vulnerable to arbitrary code execution via stack frame sandbox escape

MEDIUM 44

RestrictedPython is a tool that helps to define a subset of the Python language which allows users to provide a program input into a trusted environment.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00847 Published 2023-07-11 Fixed in 6.1, 5.3 CWE-913

TI-2023-18608 CVE-2023-36814 · GHSA-4hpj-8rhv-9x87

Resource allocation without limits in zopefoundation Products.CMFCore

MEDIUM 40

Products.CMFCore are the key framework services for the Zope Content Management Framework (CMF).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00723 Published 2023-07-03 Fixed in 3.2, 2.7.1 CWE-770

TI-2021-12476 CVE-2021-32811 · GHSA-g4gq-j4p2-j8fr

Remote Code Execution via Script (Python) objects under Python 3

LOW 37

Zope is an open-source web application server.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.02296 Published 2021-08-02 Fixed in 4.6.3, 5.3 CWE-915

TI-2021-12472 CVE-2021-32807 · GHSA-qcx9-j53g-ccgf

Remote Code Execution via unsafe classes in otherwise permitted modules

LOW 36

The module `AccessControl` defines security policies for Python code used in restricted code within Zope applications.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.02107 Published 2021-07-30 Fixed in 4.3, 5.2 CWE-915

TI-2021-14539 CVE-2021-36089 · GHSA-j6x3-x857-7j5x

Grok 7.6.6 through 9.2.0 has a heap-based buffer overflow in…

LOW 36

Grok 7.6.6 through 9.2.0 has a heap-based buffer overflow in grk::FileFormatDecompress::apply_palette_clr (called from grk::FileFormatDecompress::applyColour).

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.01175 Published 2021-07-01 No fix listed CWE-787

TI-2021-12342 CVE-2021-32674 · GHSA-rpcg-f9q6-2mq6

Remote Code Execution via traversal in TAL expressions

MEDIUM 41

Zope is an open-source web application server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01587 Published 2021-06-08 Fixed in 5.2.1, 4.6.1 CWE-22

TI-2021-12909 CVE-2021-33507 · GHSA-35rg-466w-77h3

Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as…

LOW 29

Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0075 Published 2021-05-21 Fixed in 2.5.1, 2.6.2 CWE-79

TI-2021-12302 CVE-2021-32633 · GHSA-5pr9-v234-jw36

Remote Code Execution via traversal in TAL expressions

MEDIUM 42

Zope is an open-source web application server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01858 Published 2021-05-21 Fixed in 4.6, 5.2 CWE-22

TI-2021-04459 CVE-2021-21360 · GHSA-jff3-mwp3-f8cw

Exposure of Sensitive Information to an Unauthorized Actor in Products.GenericSetup

LOW 27

Products.GenericSetup is a mini-framework for expressing the configured state of a Zope Site as a set of filesystem artifacts.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01549 Published 2021-03-09 Fixed in 2.1.1 CWE-200

TI-2021-04437 CVE-2021-21337 · GHSA-p44j-xrqg-4xrr

URL Redirection to Untrusted Site ('Open Redirect') in Products.PluggableAuthService

LOW 38

Products.PluggableAuthService is a pluggable Zope authentication and authorization framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.08443 Published 2021-03-08 Fixed in 2.6.1 CWE-601

TI-2021-04436 CVE-2021-21336 · GHSA-p75f-g7gx-2r7p

Exposure of Sensitive Information to an Unauthorized Actor in Products.PluggableAuthService ZODBRoleManager

LOW 32

Products.PluggableAuthService is a pluggable Zope authentication and authorization framework.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01499 Published 2021-03-08 Fixed in 2.6.0 CWE-200

TI-2011-04238 CVE-2011-4924 · GHSA-vh6g-786f-hxxp

Cross-site scripting in zopefoundation zope2, zope3

LOW 30

Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3, 3.1.1 through 3.4.1.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01362 Published 2019-11-25 Fixed in 2.8.12, 2.9.12 +5 CWE-79

TI-2015-06065 CVE-2015-7293 · GHSA-p3qm-44cf-f8qx

Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface…

MEDIUM 44

Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.03056 Published 2017-09-25 Fixed in 5.0a1 CWE-352

TI-2009-04891 CVE-2009-5145 · GHSA-5r4x-qc7q-vj27

Cross-site scripting (XSS) vulnerability in ZMI pages that use the manage_tabs_message in…

LOW 31

Cross-site scripting (XSS) vulnerability in ZMI pages that use the manage_tabs_message in Zope 2.11.4, 2.11.2, 2.10.9, 2.10.7, 2.10.6, 2.10.5, 2.10.4, 2.10.2, 2.10.1, 2.12.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02072 Published 2017-08-07 Partial fix · 2.12.5 CWE-79

Vulnerabilities

Filters