#cwe-1336

共收录 172 条相关情报。

漏洞预警2026-10-06 发布INFO

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs theme co...

CVE-2026-106509

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node pack

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-1336

漏洞预警2026-10-06 发布INFO

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. A low privileged att...

CVE-2026-67273

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Improper Neutralization of Special Elements Used

历史摘要 · 未重新核验 · NVD

#cve #cwe-1336

漏洞预警2026-10-06 发布INFO

Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control...

CVE-2026-105985

Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render

历史摘要 · 未重新核验 · NVD

#cve #cwe-1336

漏洞预警2026-10-02 发布INFO

fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluate...

CVE-2026-104851

fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fssp

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-1336

安全公告2026-10-02 发布INFO

fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

CVE-2026-104851

fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fssp

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-1336 #cwe-94

漏洞预警2026-10-02 发布INFO

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before ...

CVE-2026-90970

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 1

历史摘要 · 未重新核验 · NVD

#cve #cwe-1336

安全公告2026-10-02 发布INFO

Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway

CVE-2026-90970

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 1

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-1336

漏洞预警2026-10-01 发布INFO

Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Prior to version 9.1.0, a remote code execution ...

CVE-2026-53964

Document Merge Service is a document template merge service providing an API to manage templates and merge them with giv

历史摘要 · 未重新核验 · NVD

#cve #cwe-1336

安全公告2026-10-01 发布INFO

Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)

CVE-2026-53964

Document Merge Service is a document template merge service providing an API to manage templates and merge them with giv

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-1336

漏洞预警2026-10-01 发布INFO

A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/c...

CVE-2026-103540

A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the funct

历史摘要 · 未重新核验 · NVD

#cve #cwe-791 #cwe-1336

安全公告2026-10-01 发布INFO

formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engine

CVE-2026-103540

A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the funct

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-1336 #cwe-791

漏洞预警2026-09-30 发布INFO

A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stored template body. An authenticated Sy...

CVE-2026-102142

A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions c

历史摘要 · 未重新核验 · NVD

#cve #cwe-1336

漏洞预警2026-09-29 发布INFO

A security vulnerability has been detected in Naichen ThinkCMF up to 8.0.7. Affected by this issue is the function MailController::templatePut of the file cmf-api/src/admin/cont...

CVE-2026-102771

A security vulnerability has been detected in Naichen ThinkCMF up to 8.0.7. Affected by this issue is the function MailC

历史摘要 · 未重新核验 · NVD

#cve #cwe-791 #cwe-1336

安全公告2026-09-24 发布INFO

Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)

CVE-2026-57170

Reporter: Cavan Loughran, Celvex Group Inc. Summary ------- The fix for CVE-2026-46439 (3.12.2 / 4.0.3) removed the rec

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-94 #cwe-1336 #severity:high

漏洞预警2026-09-23 发布INFO

Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by th...

CVE-2026-73858

Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted

历史摘要 · 未重新核验 · NVD

#cve #cwe-1336

安全公告2026-09-23 发布INFO

Solspace Freeform: Limited Twig template injection via submitted field values

CVE-2026-73858

### Summary A limited server-side Twig template injection issue was identified in Solspace Freeform for Craft CMS. In a

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #composer #cwe-1336 #severity:medium

安全公告2026-09-23 发布INFO

Solspace Freeform: Limited Twig template injection via submitted field values

CVE-2026-73858

Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-1336

漏洞预警2026-09-23 发布INFO

ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vulnerable to a Server-Side Template Injection vulnerabilit...

CVE-2026-12370

ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vu

历史摘要 · 未重新核验 · NVD

#cve #cwe-1336

安全公告2026-09-20 发布INFO

openEQUELLA versions before 2026.1.0 contain a remote code execution vulnerability in FreeMarker...

CVE-2026-94109

openEQUELLA versions before 2026.1.0 contain a remote code execution vulnerability in FreeMarker template compilation du

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-1336 #severity:high

漏洞预警2026-09-20 发布HIGH

openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml() that allows any authenticated...

CVE-2026-94109

openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerP

来源摘录 · NVD

#cve #cwe-1336