How many CVEs does Plone have?

Plone has 119 published CVE records since 2006, including 3 in the last two years.

How many Plone CVEs are in CISA KEV?

None of Plone's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which Plone products have the most CVEs?

The Plone products with the most published CVEs are plone, Products.CMFPlone, Plone CMS, volto, @plone/volto.

What are the most common weakness types in Plone CVEs?

Plone's CVEs most often map to these CWE weakness types: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-601 (URL Redirection to Untrusted Site ('Open Redirect')), CWE-287 (Improper Authentication).

Are there public exploits for Plone vulnerabilities?

Yes — 15 of Plone's CVEs have a known public exploit.

How many critical Plone vulnerabilities are there?

Plone has 10 critical and 46 high-severity CVEs.

What is the average severity of Plone CVEs?

The average CVSS base score across Plone's scored CVEs is 6.9.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

119 CVEs

Plone Vulnerabilities

Name: Plone vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for Plone.

119

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

15

Public exploits

PoC or exploit code

6.9

Avg CVSS

2006–2026

Overview

Plone has 119 published CVE records since 2006, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 15 have a known public exploit. The average CVSS base score across scored CVEs is 6.9.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Plone products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on Plone's vulnerability posture, as a share of its 119 published CVEs.

Average CVSS: 6.9
Critical / high: 47%
Actively exploited (KEV): 0%
Public exploit available: 13%
Patch available: 93%

Severity and exploitation

How the CVSS severity of Plone's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical10

High46

Medium61

Low2

In CISA’s Known Exploited Vulnerabilities catalog

0

None of Plone's CVEs are currently listed in CISA's KEV catalog.

Public exploits

15

15 of Plone's CVEs have a known public exploit available.

Most affected products

The Plone products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in Plone CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish Plone CVE records.

Disclosure activity by year

How many Plone CVEs were published each year.

2018

4

2020

11

2021

14

2022

2

2023

3

2024

5

2025

2

2026

1

Latest Plone CVEs

The most recently disclosed vulnerabilities affecting Plone.

Products.isurlinportal: Possible open redirect when using more than 2 forward slashes
CWE-601
Medium · CVSS 6.1
EPSS 0.2%2026-03-05
@plone/volto vulnerable to potential DoS by invoking specific URL by anonymous user
CWE-476
High · CVSS 8.7
EPSS 0.4%2025-10-02
Volto affected by possible DoS by invoking specific URL by anonymous user
CWE-755
High · CVSS 7.5
EPSS 0.6%2025-08-28
High vulnerability · 2024-03-05
CWE-276
High · CVSS 7.5
EPSS 0.7%2024-03-05
High vulnerability · 2024-02-08
High · CVSS 7.5
EPSS 0.6%2024-02-08
Critical vulnerability · 2024-02-05
CWE-427
Critical · CVSS 9.8
EPSS 1.3%2024-02-05
Medium vulnerability · 2024-01-25
Medium · CVSS 6.1
EPSS 0.9%2024-01-25
High vulnerability · 2024-01-18
CWE-1021
High · CVSS 7.1
EPSS 0.3%2024-01-18
Medium vulnerability · 2023-09-21
CWE-400
Medium · CVSS 6.6
EPSS 0.8%2023-09-21
plone.namedfile vulnerable to Stored Cross Site Scripting with SVG images
CWE-79
Medium · CVSS 5.4
EPSS 0.5%2023-09-21
High vulnerability · 2023-02-17
CWE-918
High · CVSS 8.7
EPSS 1.0%2023-02-17
High vulnerability · 2022-03-14
CWE-287
High · CVSS 7.5
EPSS 0.6%2022-03-14

Track new Plone CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor Plone CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

ui120 CVEs webmin120 CVEs asterisk119 CVEs Axis Communications119 CVEs chadhaajay119 CVEs Checkmk119 CVEs digium119 CVEs microweber119 CVEs

Browse all vendors

Frequently asked questions

Common questions about Plone vulnerabilities.

How many CVEs does Plone have?: Plone has 119 published CVE records since 2006, including 3 in the last two years.
How many Plone CVEs are in CISA KEV?: None of Plone's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which Plone products have the most CVEs?: The Plone products with the most published CVEs are plone, Products.CMFPlone, Plone CMS, volto, @plone/volto.
What are the most common weakness types in Plone CVEs?: Plone's CVEs most often map to these CWE weakness types: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-601 (URL Redirection to Untrusted Site ('Open Redirect')), CWE-287 (Improper Authentication).
Are there public exploits for Plone vulnerabilities?: Yes — 15 of Plone's CVEs have a known public exploit.
How many critical Plone vulnerabilities are there?: Plone has 10 critical and 46 high-severity CVEs.
What is the average severity of Plone CVEs?: The average CVSS base score across Plone's scored CVEs is 6.9.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Plone vulnerabilities

Monitor new Plone vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing