CVE-2026-57576
plone.app.dexterity is a content-type system for the Plone content management system, and plone.app.contenttypes provides Plone’s Dexterity-
CVSS
6.5
Medio
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 22 sept 2026 · Última mod.: 22 sept 2026 · CWE-400
Sin historial EPSS suficiente todavía.
plone.app.dexterity is a content-type system for the Plone content management system, and plone.app.contenttypes provides Plone’s Dexterity-based content types. Plone.app.dexterity versions through 3.2.2, 4.0.0 through 4.1.2, and 5.0.0, and plone.app.contenttypes versions through 3.0.11, 4.0.0 through 4.0.9, and 5.0.0 are vulnerable to denial of service because an authenticated user can create content with excessively long titles, descriptions, or uploaded-file names, causing Plone to become unresponsive and potentially making the resulting content difficult to edit or delete. The vulnerability is patched in plone.app.dexterity versions 3.2.3, 4.1.3, and 5.0.1, and in plone.app.contenttypes versions 3.0.12, 4.0.10, and 5.0.1.
- github.comhttps://github.com/plone/plone.app.contenttypes/commit/13dc98a578341aac24a1e65fd9bc7ac8a07d168a
- github.comhttps://github.com/plone/plone.app.contenttypes/commit/21bae6ebe424689eeac9a5884fc0da35f4944e63
- github.comhttps://github.com/plone/plone.app.contenttypes/commit/639c0619f371df578e69ec94e5ca98e60fd6ed58
- github.comhttps://github.com/plone/plone.app.contenttypes/commit/7bb03e8ec6c6bd0e645f445b0755e85a51afb158
- github.comhttps://github.com/plone/plone.app.contenttypes/commit/bed1547d4f8b1fc995f2c76f30ba5f20276a8ad6
- github.comhttps://github.com/plone/plone.app.contenttypes/security/advisories/GHSA-8pcw-h6w9-h46g
- github.comhttps://github.com/plone/plone.app.dexterity/commit/0d317df663823445200d0569a66a95b7e4a9c50d
- github.comhttps://github.com/plone/plone.app.dexterity/commit/2fdceb120ca86682a408f3a14753cfcf5126d9d9
- github.comhttps://github.com/plone/plone.app.dexterity/commit/411689047f9a3521899ae6992a9b0efbd0592a8f
- github.comhttps://github.com/plone/plone.app.dexterity/commit/cbcef731c0882146b9bf30688cdc639d879878fb
- github.comhttps://github.com/plone/plone.app.dexterity/commit/f3596538cf7670bb8bc27b0dfa0b1da41c8b8a3a
- github.comhttps://github.com/plone/plone.app.dexterity/commit/fb45bfdb18f1dfb3ed55e477947a3df9a6ee9e20
- github.comhttps://github.com/plone/plone.app.dexterity/security/advisories/GHSA-5426-92w4-wvhv
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-174656.5 MED—
———IBM Concert 1.0.0 through 3.0.0 could allow a remote authenticated attacker to cause a denial of service due to improper enforcement of storage limits.5hCVE-2026-773996.5 MED—
——0icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 6.1.0 until 7.2.2, vInt.from_ical accepts an attacker-controlled VALARM REPEAT value and applications that request alarm times can eagerly expand it without an application-level limit. Alarms.times and Alarms.active reach the unbounded expansion in versions starting with 6.1.0, while Alarm.triggers adds a second affected path starting with 7.0.0. Parsing alone does not trigger the issue, but accessing these properties can consume excessive CPU time and heap memory and terminate or stall a service. This issue is fixed in version 7.2.2.8hCVE-2026-756327.5 ALT—
——0CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.8hCVE-2026-836006.5 MED—
——0Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized CHART SLOT value that str2ull_encoded passes to pluginsd_rrdset_cache_put_to_slot in src/plugins.d/pluginsd_internals.h. The accepted slot drives reallocz to request an approximately 16 GiB chart-pointer array, and allocation failure invokes fatal and aborts the parent Netdata agent, repeatedly disabling centralized monitoring while stream access persists. This issue is fixed in version 2.10.4 and nightly build 2.10.0-782-nightly.8hCVE-2026-946407.5 ALT—
——0A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of unique requests. The rpcbind service records previously unseen RPC (Remote Procedure Call) statistics in unbounded in-memory lists, leading to persistent memory growth and increased CPU usage. This can degrade or exhaust service availability.7hCVE-2026-818805.5 MED—
——0radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Apple Preferred Executable Format loader was vulnerable because the PEF loader accepted relocSecCount values that were not bounded by the number of sections or complete relocation records in the input. The vulnerability is triggered by normal binary-format auto-detection of a small crafted Apple PEF file. The loader could perform up to 268,435,456 relocation-section iterations and repeated buffer operations after record offsets passed the end of the file. This can cause denial of service through excessive CPU consumption and prolonged processing. This issue is fixed in version 6.2.0.11h