{"action":"Upgrade tendenci to 15.3.12 or later.","affected":[{"fixed":"15.3.12","introduced":"0"}],"component":"tendenci","cve_ids":["CVE-2026-23946"],"ecosystem":"PyPI","epss":0.00837,"exploited":false,"fixed_versions":["15.3.12"],"ghsa_id":"GHSA-339m-4qw5-j2g3","id":"tcs_01M5KGWMS60X0WQRJ7CFQXM4J7","modified_at":"2026-07-07T17:48:12.950112553Z","published_at":"2026-07-07T16:03:19.523094Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1950","https://github.com/tendenci/tendenci/security/advisories/GHSA-339m-4qw5-j2g3","https://nvd.nist.gov/vuln/detail/CVE-2020-14942","https://nvd.nist.gov/vuln/detail/CVE-2026-23946","https://github.com/tendenci/tendenci/issues/867","https://github.com/tendenci/tendenci/commit/23d9fd85ab7654e9c83cfc86cb4175c0bd7a77f1","https://github.com/tendenci/tendenci/commit/2ff0a457614944a1b417081c543ea4c5bb95d636","https://github.com/tendenci/tendenci/commit/63e1b84a5b163466d1d8d811d35e7021a7ca0d0e","https://docs.python.org/3/library/pickle.html#restricting-globals","https://github.com/advisories/GHSA-jqmc-fxxp-r589","https://github.com/tendenci/tendenci","https://github.com/tendenci/tendenci/releases/tag/v15.3.12","https://pypi.org/project/tendenci","https://github.com/advisories/GHSA-339m-4qw5-j2g3"],"severity":{"label":"medium","score":6.8},"sources":[{"source":"osv","source_id":"PYSEC-2026-1950","url":"https://osv.dev/vulnerability/PYSEC-2026-1950"}],"summary":"Tendenci Affected by Authenticated Remote Code Execution via Pickle Deserialization"}