Plone community security announcements

plone-security-announcements · A · candidate

https://community.plone.org/t/plone-security-hotfix-20261110/23313

vendor-psirtvulnslang: enfetch failures: 0quiet periods: 0last fetch: 2026-11-12

Added 2026-11-12 (S1): the Plone security team announces fixes and pre-announcements on community.plone.org (the 2026-11-10 hotfix and the 2026-11-02 pre-announcement); `extract` reads the posts and the five GitHub advisories they link. Candidate for the CMS sweep; promote to active after 3 contributing runs.

Cited in 1 entry

Citation cadence

Citation days per ISO week (1 weeks of coverage span, total 1).

Plone security fix of 2026-11-10: a chain of missing security declarations and opened modules lets an anonymous visitor run code on the server in every supported Plone version and back to 4.3; a working proof of concept exists, no CVE ids yet, no exploitation reported2026-11-12