Do Son A critical Plone RCE vulnerability (CVE-2026-57149, CVSS 9.9) allows TALES injection via the Classic portlet. Two more flaws enable DoS and SSRF.
Plone
A high-severity DoS flaw (CVE-2025-58047) in Volto, the frontend for Plone CMS, allows an unauthenticated user to crash the server with a single crafted URL.