CVE-2026-102771 | Medium | 4.7 | 2026-09-29 | A security vulnerability has been detected in Naichen ThinkCMF up to 8.0.7. Affected by this issue is the function MailController::templatePut of the file cmf-… |
CVE-2026-84462 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a security filter that protects Zammad's AI Agent configuration can be bypa… |
CVE-2026-97359 | Critical | 10.0 | 2026-09-24 | HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve rem… |
CVE-2026-73858 | Medium | 5.3 | 2026-09-23 | Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can… |
CVE-2026-12370 | High | 7.6 | 2026-09-23 | ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vulnerable to a Server-Side Template Inje… |
CVE-2026-94109 | High | 8.0 | 2026-09-20 | openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml() that allows… |
CVE-2026-92592 | High | 8.8 | 2026-09-16 | Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used… |
CVE-2026-88064 | High | 8.8 | 2026-09-16 | Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backstage/plugin-techdocs-node package insuff… |
CVE-2026-91925 | High | 8.8 | 2026-09-15 | Polyaxon through 2.16.4 renders operation specification fields with an unsandboxed Jinja2 environment during server-side run preparation, allowing authenticate… |
CVE-2026-81910 | Medium | 6.5 | 2026-09-11 | Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values. Values submitted through… |
CVE-2026-9160 | Medium | 4.3 | 2026-09-11 | Improper neutralization of special elements used in a template engine vulnerability in Arma Digital Media Inc. Website Template allows Code Injection.
This is… |
CVE-2026-89094 | Critical | 9.9 | 2026-09-10 | Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled. |
CVE-2026-19584 | High | 7.7 | 2026-09-10 | Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell… |
CVE-2026-87021 | High | 7.2 | 2026-09-09 | Tanium addressed an unauthorized code execution vulnerability in Comply. |
CVE-2026-33387 | Medium | 4.6 | 2026-09-08 | A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated user with… |
CVE-2026-75650 | Critical | 10.0 | 2026-09-07 | Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execut… |
CVE-2026-52762 | | | 2026-09-05 | YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki Bazar contains a stored Server-Side Template Injection (SSTI) vulnerability in the sem… |
CVE-2026-46636 | | | 2026-09-04 | Twig is a template language for PHP. From version 1.0.0 to before version 3.27.0, SecurityPolicy::checkMethodAllowed() unconditionally whitelists all method ca… |
CVE-2026-85654 | High | 7.8 | 2026-09-04 | Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might allow a con… |
CVE-2026-13297 | High | 7.5 | 2026-09-04 | IBM Verify Identity Access Advanced Access Control may be vulnerable to an information disclosure attack. |
CVE-2026-75036 | | | 2026-09-03 | A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet controller could reach network resources… |
CVE-2026-82958 | | | 2026-09-02 | In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting place… |
CVE-2026-12894 | High | 8.8 | 2026-08-31 | A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component… |
CVE-2026-82447 | High | 8.8 | 2026-08-29 | Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and th… |
CVE-2026-77939 | Medium | 6.5 | 2026-08-28 | Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbi… |
CVE-2026-55559 | Critical | 9.8 | 2026-08-28 | Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs inserts templateArgs from POST /api/instances and PATCH /api/instances/{instance} into… |
CVE-2026-54718 | High | 7.2 | 2026-08-27 | Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an attacker with permission to author the… |
CVE-2026-47727 | | | 2026-08-27 | Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the default-on "Safe import" filter fails to neutralize the share… |
CVE-2026-37004 | Critical | 9.8 | 2026-08-27 | BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands… |
CVE-2026-57170 | High | 7.8 | 2026-08-26 | Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3… |
CVE-2026-77136 | | | 2026-08-25 | The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, wi… |
CVE-2026-77129 | | | 2026-08-25 | The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction. A backend user with edit access to… |
CVE-2026-75574 | High | 8.8 | 2026-08-25 | The Grav Email plugin (getgrav/grav-plugin-email) before 4.2.2 renders page-editor-controlled Email action parameters as unsandboxed Twig templates. An authent… |
CVE-2026-78140 | Medium | 4.7 | 2026-08-23 | A flaw has been found in Dromara UJCMS up to 10.1.3. The impacted element is the function update of the file src/main/java/com/ujcms/cms/ext/web/backendapi/Web… |
CVE-2026-59989 | | | 2026-08-21 | Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filt… |
CVE-2026-72717 | | | 2026-08-19 | Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a… |
CVE-2026-72716 | | | 2026-08-19 | Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a… |
CVE-2026-71871 | | | 2026-08-19 | Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a… |
CVE-2026-71869 | | | 2026-08-19 | Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a… |
CVE-2026-71868 | | | 2026-08-19 | Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a… |
CVE-2026-62682 | | | 2026-08-19 | Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in servers[0]… |
CVE-2026-62681 | | | 2026-08-19 | Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI… |
CVE-2026-52889 | Critical | 9.8 | 2026-08-19 | Formie is a Craft CMS plugin for creating forms. Prior to 3.1.27, Formie can pass request-derived Hidden field defaults such as HTTP User Agent, Referer URL, C… |
CVE-2026-66613 | Critical | 9.8 | 2026-08-19 | Unauthenticated Remote Code Execution (RCE) in JetEngine <= 3.8.14 versions. |
CVE-2026-75979 | Medium | 6.3 | 2026-08-19 | A vulnerability was found in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected is the function execSqlText/previewSqlText of the file DesignerController.j… |
CVE-2026-71880 | | | 2026-08-18 | Interpretation of untrusted input in template engine in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to acces… |
CVE-2026-75829 | High | 8.1 | 2026-08-18 | grav-plugin-api versions before 1.0.15 fail to validate Twig content in the translate() endpoint, allowing attackers with api.pages.write permission to persist… |
CVE-2026-65974 | Critical | 9.9 | 2026-08-17 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary… |
CVE-2026-44845 | Medium | 6.7 | 2026-08-17 | JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, an authenticated administrator with Applet… |
CVE-2026-19929 | Medium | 6.3 | 2026-08-16 | A vulnerability was identified in OpenBoxes up to 0.9.6. This impacts the function buildZebraTemplate of the file grails-app/controllers/org/pih/warehouse/core… |
CVE-2026-46439 | High | 7.8 | 2026-08-14 | compliance-trestle is a tooling platform for managing compliance as code. Versions prior to 3.12.2 and 4.0.3 have a Server-Side Template Injection (SSTI) vulne… |
CVE-2026-72827 | High | 8.8 | 2026-08-14 | Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute ar… |
CVE-2026-13051 | Critical | 9.1 | 2026-08-13 | Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy… |
CVE-2022-4993 | Critical | 9.1 | 2026-08-13 | HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use er… |
CVE-2026-73505 | High | 7.8 | 2026-08-13 | Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go pas… |
CVE-2026-73330 | Medium | 6.6 | 2026-08-12 | CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to execute arbitrary commands by embedding E… |
CVE-2026-73299 | Critical | 10.0 | 2026-08-12 | Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty te… |
CVE-2026-72911 | Critical | 9.9 | 2026-08-10 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validate_template and render_template calls in erpnext/… |
CVE-2026-69118 | High | 8.8 | 2026-08-10 | Cachet through 2.4.1 contains a server-side template injection vulnerability in incident template rendering that allows authenticated users to execute arbitrar… |
CVE-2026-71502 | | | 2026-08-08 | CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-render… |
CVE-2026-5336 | Medium | 6.8 | 2026-08-06 | The DataPress (Dataverse Integration) WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes the viewing… |
CVE-2026-15734 | Critical | 9.8 | 2026-08-06 | A Server-Side Template Injection (SSTI) vulnerability in WGDashboard version 4.3.2 and earlier, allows authenticated attackers to execute arbitrary code as roo… |
CVE-2026-71291 | High | 8.8 | 2026-08-05 | Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/En… |
CVE-2026-71286 | Medium | 6.1 | 2026-08-05 | The render-template component of ember-dynamic-render-template (addon/components/render-template.js) passes its property directly into Ember/Glimmer's compileT… |
CVE-2026-71239 | High | 8.1 | 2026-08-05 | DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Django's Template constructor with no sanitization, in at leas… |
CVE-2026-48323 | Critical | 10.0 | 2026-08-03 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitra… |
CVE-2026-18632 | Medium | 6.3 | 2026-08-03 | A security flaw has been discovered in langgenius dify up to 1.14.2. This issue affects the function jinja2.Template of the file api/core/helper/code_executor/… |
CVE-2026-54666 | High | 8.3 | 2026-07-29 | swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-routes/schema-routes.ts passes Open… |
CVE-2026-54664 | High | 8.3 | 2026-07-29 | swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-parser/base-schema-parsers/enum.ts… |
CVE-2026-54662 | High | 8.3 | 2026-07-29 | swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies s… |
CVE-2026-54661 | High | 8.3 | 2026-07-29 | swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client… |
CVE-2026-9177 | | | 2026-07-29 | A Server-Side Template Injection (SSTI) vulnerability was identified
in the mail template functionality of the Axway SecureTransport product in version 5.5-20… |
CVE-2026-54654 | High | 7.8 | 2026-07-28 | datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered in… |
CVE-2026-54653 | High | 8.8 | 2026-07-28 | datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw J… |
CVE-2026-54621 | High | 7.8 | 2026-07-28 | datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodel_code_generato… |
CVE-2026-47752 | Critical | 9.9 | 2026-07-23 | Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2 are vulnerable to Server-Side Template Injection (SSTI) in… |
CVE-2026-47690 | High | 7.5 | 2026-07-21 | MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions of the repo prior to commit 923820de8f64d753951fbbd54f7282a3… |
CVE-2026-63728 | Medium | 6.3 | 2026-07-21 | Gitleaks prior to 8.30.1 contains a template injection vulnerability that allows attackers who can supply or influence report templates to read arbitrary envir… |
CVE-2026-44181 | Critical | 10.0 | 2026-07-16 | Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. In versions 2… |
CVE-2026-55242 | High | 8.8 | 2026-07-15 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, an authenticated user with a standard operational role can… |
CVE-2026-55794 | | | 2026-07-02 | Craft CMS is a content management system (CMS). In versions 5.9.0 and above prior to 5.10.0, control panel users with the ability to edit entries can execute u… |
CVE-2026-52796 | Low | 3.5 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, specially crafted issue index pattern can cause a panic when rendering, resulting in denial of… |
CVE-2026-28496 | | | 2026-06-23 | FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 have a Server-Side Template Injection (SSTI) vulnerability in… |
CVE-2026-54390 | Critical | 9.8 | 2026-06-18 | JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection vulnerability that allows unauthenticated attackers to inject malicious templat… |
CVE-2026-11407 | High | 7.2 | 2026-06-17 | Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allows authenticated administrative attackers to execute arbitrary methods on PHP o… |
CVE-2026-41065 | | | 2026-06-04 | Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 are vulnerable to remote code execution via the newslet… |
CVE-2026-34906 | | | 2026-06-02 | Server-Side Template Injection (SSTI) in Wirtualna Uczelnia allows an unauthenticated attacker to perform Remote Code Execution (RCE). In the endpoint redirect… |
CVE-2026-42252 | Critical | 9.1 | 2026-06-01 | Apache Airflow's official documentation at `core-concepts/dag-run.html` ("Passing Parameters when triggering Dags") showed a verbatim `BashOperator(bash_comman… |
CVE-2026-45697 | Critical | 9.8 | 2026-05-29 | Formie is a Craft CMS plugin for creating forms. Prior to 2.2.20 and 3.1.24, unauthenticated users could submit crafted values into Hidden fields (with Default… |
CVE-2026-49382 | Medium | 4.5 | 2026-05-29 | In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright plugin |
CVE-2026-45312 | Critical | 9.9 | 2026-05-29 | RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In 0.24.0 and earlier, a Jinja2 template injection in the prompt generator (rag/prompts/… |
CVE-2026-9558 | Critical | 9.9 | 2026-05-29 | A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict… |
CVE-2026-44209 | High | 7.5 | 2026-05-26 | Banks generates meaningful LLM prompts using a template language that makes sense. Prior to 2.4.2, banks uses jinja2.Environment() (unsandboxed) to render prom… |
CVE-2026-44723 | Medium | 5.0 | 2026-05-26 | Vowpal Wabbit is a machine learning system. The workflow .github/workflows/python_checks.yml embeds ${{ github.event.pull_request.title }} directly inside doub… |
CVE-2026-9498 | Medium | 6.3 | 2026-05-25 | A vulnerability has been found in Dromara lamp-cloud up to 5.6.2. Impacted is the function GroovyClassLoader.parseClass of the component Message Template Handl… |
CVE-2025-40900 | Medium | 4.6 | 2026-05-19 | An Angular template injection vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. An authenticated user… |
CVE-2026-29207 | Medium | 6.5 | 2026-05-19 | Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz.
This issue affects Apache OFBiz: before 24.09.06.
Users… |
CVE-2026-8740 | Medium | 6.3 | 2026-05-17 | A flaw has been found in Sanluan PublicCMS 5.202506.d. The impacted element is the function execute of the file publiccms-core/src/main/java/com/publiccms/view… |
CVE-2026-45714 | Critical | 9.1 | 2026-05-13 | CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection (SSTI) vulnerability exists in multiple modules of… |
CVE-2026-44377 | Critical | 9.1 | 2026-05-13 | CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection (SSTI) vulnerability exists in multiple modules of… |