Zopefoundation vulnerabilities

Products

• Restrictedpython 6
• Zope 5
• Accesscontrol 4
• Products.pluggableauthservice 2

Newest

• zopefoundation accesscontrol Zope AccessControl: Information disclosure through Python string `format` and `format_map` functions CVE-2026-77401 Fix available 6.8 MediumSeptember 16, 2026
• zopefoundation restrictedpython RestrictedPython: Sandbox escape via string.Formatter field resolution CVE-2026-76825 Fix available 8.4 HighSeptember 16, 2026
• zopefoundation restrictedpython RestrictedPython guard hooks can be shadowed via positional-only arguments CVE-2026-55830 Fix available 8.3 HighJuly 8, 2026
• zopefoundation restrictedpython try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreter CVE-2025-22153 Fix available 7.9 HighJanuary 23, 2025
• zope accesscontrol User data deletion by anoynmous users in Zope CVE-2024-51734 Fix available 8.7 HighNovember 4, 2024
• zope restrictedpython RestrictedPython information leakage via `AttributeError.obj` and the `string` module CVE-2024-47532 Fix available 8.7 HighSeptember 30, 2024
• zope sqlalchemyda, zopefoundation products.sqlalchemyda +1 more Products.SQLAlchemyDA vulnerable to unauthenticated arbitrary SQL query execution CVE-2024-24811 Fix available 9.8 CriticalFebruary 7, 2024
• zope Zope management interface vulnerable to stored cross site scripting via the title property CVE-2023-44389 Fix available 3.1 LowOctober 4, 2023
• zope Zope vulnerable to Stored Cross Site Scripting with SVG images CVE-2023-42458 Fix available 3.7 LowSeptember 21, 2023
• zope accesscontrol, zope +1 more Information disclosure through Python's "format" functionality in Zope AccessControl CVE-2023-41050 Fix available 6.8 MediumSeptember 6, 2023
• zope restrictedpython Sandbox escape via various forms of "format" in RestrictedPython CVE-2023-41039 Fix available 8.3 HighAugust 30, 2023
• zope restrictedpython RestrictedPython vulnerable to arbitrary code execution via stack frame sandbox escape CVE-2023-37271 Fix available 8.4 HighJuly 10, 2023
• zope products.cmfcore zopefoundation's Products.CMFCore vulnerable to unauthenticated denial of service and crash via unchecked use of input with Python's marshal module CVE-2023-36814 Fix available 7.5 HighJuly 3, 2023
• zope, zope accesscontrol +1 more Remote Code Execution via Script (Python) objects under Python 3 CVE-2021-32811 Fix available 7.5 HighAugust 2, 2021
• zope accesscontrol Remote Code Execution via unsafe classes in otherwise permitted modules CVE-2021-32807 Fix available 4.4 MediumJuly 30, 2021
• zope Remote Code Execution via traversal in TAL expressions CVE-2021-32674 Fix available 8.8 HighJune 8, 2021
• zope, plone +1 more Remote Code Execution via traversal in TAL expressions CVE-2021-32633 Fix available 6.8 MediumMay 21, 2021
• zope products.genericsetup Exposure of Sensitive Information to an Unauthorized Actor in Products.GenericSetup CVE-2021-21360 Fix available 5.3 MediumMarch 9, 2021
• zope products.pluggableauthservice URL Redirection to Untrusted Site ('Open Redirect') in Products.PluggableAuthService CVE-2021-21337 Public exploitFix available 5.7 MediumMarch 8, 2021
• zope products.pluggableauthservice, plone +1 more Exposure of Sensitive Information to an Unauthorized Actor in Products.PluggableAuthService ZODBRoleManager CVE-2021-21336 Fix available 6.5 MediumMarch 8, 2021