Loading story…
The Plone/Zope Security Team disclosed multiple security fixes affecting Plone and related Python components, including a critical remote code execution flaw caused by TALES injection in plone.app.portlets, a sandbox escape in RestrictedPython, and a stored XSS issue tied to MIME type spoofing. The advisory also covered several denial-of-service conditions in Plone features such as iCalendar import, RSS feed portlets, and handling of excessively long titles, descriptions, or filenames, with package-specific guidance issued for supported Plone 6.0, 6.1, and 6.2 deployments and fixes expected in Plone 6.1.5 and 6.2.1 releases.
Separately detailed but included in the same disclosure cycle, the Python icalendar library was found vulnerable to algorithmic-complexity denial of service tracked as CVE-2026-55099. In affected versions 7.1.0, 7.1.1, and 7.1.2, the Component.__eq__ method can take O(2^n) time when comparing attacker-supplied, deeply nested calendar components, allowing a sub-kilobyte malicious .ics file to drive CPU usage for minutes or hang a process if an application performs equality, membership, deduplication, or round-trip comparison on parsed data. Maintainers said parsing alone does not trigger the flaw, and the issue was fixed in icalendar 7.1.3 and 7.2.0 by replacing recursive comparison with a stack-based linear-time traversal.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
The Plone/Zope Security Team announced multiple security fixes for Plone and related components, including the recently disclosed denial-of-service issue in collective/icalendar alongside other vulnerabilities such as TALES injection, sandbox escape, and stored XSS. The announcement said full releases of Plone 6.1.5 and 6.2.1 were expected that week to incorporate the fixes.
Maurits van Rees, on behalf of the Plone/Zope Security Team and the icalendar maintainers, disclosed CVE-2026-55099 on the oss-sec mailing list. The notice said versions 7.1.0, 7.1.1, and 7.1.2 are affected and that the issue is fixed in icalendar 7.1.3 and 7.2.0, while versions before 7.1.0 are unaffected.
A GitHub security advisory disclosed an algorithmic-complexity denial-of-service vulnerability in the Python icalendar library's Component.__eq__ method, where deeply nested calendar components can make equality checks take minutes or hang indefinitely. The advisory described a fix that replaces recursive comparison with an explicit stack-based traversal to restore linear-time behavior.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Public disclosures highlighted multiple high-severity vulnerabilities across industrial control systems, open-source software, and consumer networking gear, with several issues enabling **unauthenticated remote compromise**. Johnson Controls disclosed **CVE-2025-26385** (CVSS 10.0), a critical SQL injection affecting multiple building/ICS management products (including *ADS/ADX, LCS8500, NAE8500, SCT, CCT*) that can allow remote, unauthenticated attackers to execute arbitrary SQL to alter/delete/exfiltrate data; CISA guidance emphasized isolating control system networks from the internet, segmentation, and controlled remote access (e.g., VPNs). Additional unauthenticated remote issues include **CVE-2026-25069** in *SunFounder Pironman Dashboard* (path traversal in log API endpoints enabling arbitrary file read/deletion) and **CVE-2025-51958** in the *DokuWiki* `runcommand` plugin (unauthenticated command execution via `lib/plugins/runcommand/postaction.php`). Other disclosures include developer-tooling and application-layer injection flaws and multiple router memory-corruption bugs with public exploit references. *Orval* fixed **CVE-2026-25141**, a code-injection issue where incomplete escaping can be bypassed using **JSFuck**-style payloads, and *Cybersecurity AI (CAI)* addressed **CVE-2026-25130**, where `subprocess.Popen(..., shell=True)` enables argument/command injection leading to RCE (notably via the `find_file()` tool). Data-layer issues include **CVE-2025-69662** in *geopandas* (`to_postgis()` SQL injection) and **CVE-2026-24854** in *ChurchCRM* (authenticated SQL injection via `PerID` in `/PaddleNumEditor.php`, patched in 6.7.2), while **CVE-2025-36384** affects *IBM Db2 for Windows* (local privilege escalation via unquoted search path). SOHO router flaws **CVE-2026-1686** (*Totolink A3600R*) and **CVE-2026-1637** (*Tenda AC21*) describe remotely reachable buffer/stack overflows with publicly available exploit material, increasing the likelihood of opportunistic exploitation where exposed management interfaces exist.
Jun 29, 2026
Zimbra disclosed security updates for Zimbra Collaboration Suite (ZCS) Daffodil releases before `10.1.21`, addressing vulnerabilities that include **CVE-2026-93643**, a critical unauthenticated path-traversal flaw in the OnlyOffice/Document Editing integration. An attacker able to access an existing supported public Briefcase document can abuse unsigned save fields in a `/downloadas` request to write files through path traversal and execute commands as the `zimbra` user; the flaw is rated CVSS 9.8. Canadian and Guyanese national cyber authorities urged administrators to review Zimbra’s release information and apply the available update. Two additional unauthenticated stored XSS vulnerabilities, **CVE-2026-93642** and **CVE-2026-93647**, can let attackers execute script in authenticated users’ browsers and access mailbox data or act as those users. The first uses a forged share invitation accepted in Zimbra Modern, while the second embeds active markup in the `From` field of a calendar `COUNTER` message viewed in the Classic client. Rapid7 warned that weaknesses across Zimbra mail, document, and calendar functions can support business email compromise campaigns that manipulate the records employees use for decisions, creating coordinated fraudulent communications and complicating forensic investigation.
Sep 29, 2026
Two high-severity vulnerabilities in the Python web UI framework **Mesop** exposed applications to unauthenticated compromise in version `1.2.2` and earlier. The most critical issue, tracked as `CVE-2026-33057`, allowed remote code execution through an exposed `/exec-py` route in Mesop's AI testing infrastructure, where a debugging Flask server accepted base64-encoded Python code and executed it without authentication. The flaw was assigned `CWE-94` and a `CVSS 3.1` score vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`. A second flaw, `CVE-2026-33054`, let attackers exploit path traversal via an untrusted `state_token` processed by `FileStateSessionBackend`, enabling file write or deletion outside intended application boundaries and potentially causing denial-of-service crash loops. That issue was classified as `CWE-22` with a `CVSS 3.1` vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`. Mesop addressed both vulnerabilities in version `1.2.3`, and GitHub published security advisories and patch references for the fixes.
Jun 29, 2026