https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T08:12:54.419073+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-274362 EUVD-2026-274362 2026-10-15T08:12:54.490119+00:00 EUVD-2026-274362 https://cve.radiocsirt.org/vuln/fkie_cve-2020-36962 fkie_cve-2020-36962 2026-10-15T08:12:54.490168+00:00

Tendenci 12.3.1 contains a CSV formula injection vulnerability in the contact form message field that allows attackers to inject malicious formulas during export. Attackers can submit crafted payloads like '=10+20+cmd|' /C calc'!A0' in the message field to trigger arbitrary command execution when the CSV is opened in spreadsheet applications.

 https://cve.radiocsirt.org/vuln/ghsa-4q3w-jgfx-4792 GHSA-4q3w-jgfx-4792 — Tendenci is Vulnerable to CSV Formula Injection through its Contact Form Message Field 2026-10-15T08:12:54.490202+00:00

Affected: PyPI: tendenci

Tendenci 12.3.1 contains a CSV formula injection vulnerability in the contact form message field that allows attackers to inject malicious formulas during export. Attackers can submit crafted payloads like '=10+20+cmd|' /C calc'!A0' in the message field to trigger arbitrary command execution when the CSV is opened in spreadsheet applications.

 https://cve.radiocsirt.org/vuln/pysec-2026-136 PYSEC-2026-136 2026-10-15T08:12:54.490228+00:00

Affected: PyPI: tendenci

Tendenci 12.3.1 contains a CSV formula injection vulnerability in the contact form message field that allows attackers to inject malicious formulas during export. Attackers can submit crafted payloads like '=10+20+cmd|' /C calc'!A0' in the message field to trigger arbitrary command execution when the CSV is opened in spreadsheet applications.