{"action":"Upgrade plone-app-portlets to 5.0.8 or later.","affected":[{"fixed":"5.0.8","introduced":"0"},{"fixed":"6.0.4","introduced":"6.0.0"},{"fixed":"7.0.2","introduced":"7.0.0"}],"component":"plone-app-portlets","cve_ids":["CVE-2026-55248"],"ecosystem":"PyPI","epss":0.00441,"exploited":false,"fixed_versions":["5.0.8","6.0.4","7.0.2"],"ghsa_id":"GHSA-x5g3-w747-2h8q","id":"tcs_01M5KH8C7NG0C2V6QTAE0J9YSW","modified_at":"2026-09-10T12:15:18.815538542Z","published_at":"2026-09-10T09:44:58.444492Z","references":["https://osv.dev/vulnerability/PYSEC-2026-3884","https://github.com/plone/plone.app.portlets/security/advisories/GHSA-x5g3-w747-2h8q","https://github.com/plone/plone.app.portlets/commit/09da52ef7b297daa8e0cfd2361e47c37d9b073ad","https://github.com/plone/plone.app.portlets/commit/9f16b6fb10211916686c6c346ea174bf517e3fbd","https://github.com/plone/plone.app.portlets/commit/a3b2c2887165b308cd915cbb87b8276f90a76680","https://github.com/plone/plone.app.portlets/commit/df5e256baee55083cbd6b9a2623675d4cb26b6cd","https://github.com/plone/plone.app.portlets","https://pypi.org/project/plone-app-portlets","https://github.com/advisories/GHSA-x5g3-w747-2h8q","https://nvd.nist.gov/vuln/detail/CVE-2026-55248"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"PYSEC-2026-3884","url":"https://osv.dev/vulnerability/PYSEC-2026-3884"}],"summary":"plone.app.portlets vulnerable to denial of service via RSS feed portlet"}