PatchTheCVEtendenci vulnerabilities
Recent CVEs affecting tendenci products. 4 tracked.
tendenci has 4 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 2. Most recent: 2026-02-02. Highest priority: CVE-2020-36962 (score 68/100).
- CVE-2020-36962 CRITICAL 9.8 DOWNGRADE Tendenci 12.3.1 contains a CSV formula injection vulnerability in the contact form message field that allows a
- CVE-2026-23946 MEDIUM 6.8 UPGRADE Tendenci is an open source content management system built for non-profits, associations and cause-based sites
- CVE-2025-70960 MEDIUM 5.4 DOWNGRADE A stored cross-site scripting (XSS) vulnerability in the Forums module of Tendenci CMS v15.3.7 allows attacker
- CVE-2025-70959 MEDIUM 5.4 DOWNGRADE A stored cross-site scripting (XSS) vulnerability in the Jobs module of Tendenci CMS v15.3.7 allows attackers
FAQ
How do I fix tendenci vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is tendenci being exploited right now?
None of the tracked tendenci CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which tendenci CVE should I patch first?
CVE-2020-36962 currently ranks highest (68/100): Tendenci 12.3.1 contains a CSV formula injection vulnerability in the contact form message field that allows a.