# tendenci (PyPI) vulnerabilities

5 known vulnerabilities (4 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://pypi.org/project/tendenci/

## Advisories (5)

### [CVE-2025-70960](https://cve.now/CVE-2025-70960): A stored cross-site scripting (XSS) vulnerability in the Forums module of Tendenci CMS v15.3.7 allows attackers to execute arbitrary web…

- Severity: Medium 5.4
- Published: Feb 2, 2026
- Affected: through 16.14; through 15.3.7.

### [CVE-2025-70959](https://cve.now/CVE-2025-70959): A stored cross-site scripting (XSS) vulnerability in the Jobs module of Tendenci CMS v15.3.7 allows attackers to execute arbitrary web…

- Severity: Medium 5.4
- Published: Feb 2, 2026
- Affected: through 15.3.7.

### [CVE-2020-36962](https://cve.now/CVE-2020-36962): Tendenci 12.3.1 - CSV/ Formula Injection

- Severity: Medium 5.3
- Published: Jan 28, 2026
- Affected: fixed in 12.3.2; through 12.3.1.

### [CVE-2026-23946](https://cve.now/CVE-2026-23946): Tendenci has Authenticated Remote Code Execution via Pickle Deserialization

- Severity: Medium 6.8
- Published: Jan 22, 2026
- Affected: fixed in 15.3.12.

### [CVE-2020-14942](https://cve.now/CVE-2020-14942): Tendenci 12.0.10 allows unrestricted deserialization in apps\\helpdesk\\views\\staff.py.

- Severity: Unrated
- Published: Jun 21, 2020
- Affected: fixed in 12.0.11; fixed in 12.0.11.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/pypi/tendenci
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.