{"action":"Upgrade tendenci to 15.3.12 or later.","affected":[{"fixed":"15.3.12","introduced":"0"}],"component":"tendenci","cve_ids":["CVE-2026-23946"],"ecosystem":"PyPI","epss":0.00837,"exploited":false,"fixed_versions":["15.3.12"],"ghsa_id":"GHSA-339m-4qw5-j2g3","id":"tcs_01M5KETP8QSE55E81KDTH1TDE6","modified_at":"2026-07-07T17:56:39.916307506Z","published_at":"2026-01-21T16:38:15Z","references":["https://osv.dev/vulnerability/GHSA-339m-4qw5-j2g3","https://github.com/tendenci/tendenci/security/advisories/GHSA-339m-4qw5-j2g3","https://nvd.nist.gov/vuln/detail/CVE-2020-14942","https://nvd.nist.gov/vuln/detail/CVE-2026-23946","https://github.com/tendenci/tendenci/issues/867","https://github.com/tendenci/tendenci/commit/23d9fd85ab7654e9c83cfc86cb4175c0bd7a77f1","https://github.com/tendenci/tendenci/commit/2ff0a457614944a1b417081c543ea4c5bb95d636","https://github.com/tendenci/tendenci/commit/63e1b84a5b163466d1d8d811d35e7021a7ca0d0e","https://docs.python.org/3/library/pickle.html#restricting-globals","https://github.com/advisories/GHSA-jqmc-fxxp-r589","https://github.com/tendenci/tendenci","https://github.com/tendenci/tendenci/releases/tag/v15.3.12"],"severity":{"label":"medium","score":6.8},"sources":[{"source":"osv","source_id":"GHSA-339m-4qw5-j2g3","url":"https://osv.dev/vulnerability/GHSA-339m-4qw5-j2g3"}],"summary":"Tendenci Affected by Authenticated Remote Code Execution via Pickle Deserialization"}