openEQUELLA before 2026.1.0 Remote Code Execution via FreeMarker Template Injection
CVE-2026-94109
openEQUELLA versions before 2026.1.0 contain a remote code execution vulnerability in FreeMarker template compilation du
#cwe-1336
共收录 172 条相关情报。
← 返回所有主题Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker...
CVE-2026-92592
Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun c
Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used to validate signe...
CVE-2026-92592
Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun c
Grav: XSS Blueprint Validation Bypass via Twig String Concatenation
CVE-2026-61453
## Summary The XSS blueprint validator (`Security::detectXss()`) runs on the **raw page content before Twig processing*
Polyaxon through 2.16.4 renders operation specification fields with an unsandboxed Jinja2 environment during server-side run preparation, allowing authenticated users to execute...
CVE-2026-91925
Polyaxon through 2.16.4 renders operation specification fields with an unsandboxed Jinja2 environment during server-side
Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values. Values submitted through the customizer (co...
CVE-2026-81910
Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated
Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values
CVE-2026-81910
Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated
Improper neutralization of special elements used in a template engine vulnerability in Arma Digital Media Inc. Website Template allows Code Injection. This issue affects Websit...
CVE-2026-9160
Improper neutralization of special elements used in a template engine vulnerability in Arma Digital Media Inc. Website T
Forgejo before 16.0.4 allows remote code execution via a crafted template repository because...
CVE-2026-89094
Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files
Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled.
CVE-2026-89094
Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files
Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpo...
CVE-2026-19584
Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor
Velociraptor VQL injection during notebook restore from backup
CVE-2026-19584
Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor
Tanium addressed an unauthorized code execution vulnerability in Comply.
CVE-2026-87021
Tanium addressed an unauthorized code execution vulnerability in Comply.
A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated user with the required privi...
CVE-2026-33387
A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template...
CVE-2026-75650
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability tha
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context...
CVE-2026-75650
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability tha
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki Bazar contains a stored Server-Side Template Injection (SSTI) vulnerability in the semantic template fea...
CVE-2026-52762
CVE-2026-52762 是 YesWiki（基于 PHP 的 wiki 系统）中存在的一个存储型服务端模板注入（SSTI）漏洞，影响 4.6.6 之前的版本。漏洞位于 Bazar 组件的语义模板功能中。具有管理员权限的认证用户可以在
Twig is a template language for PHP. From version 1.0.0 to before version 3.27.0, SecurityPolicy::checkMethodAllowed() unconditionally whitelists all method calls on instances o...
CVE-2026-46636
Twig is a template language for PHP. From version 1.0.0 to before version 3.27.0, SecurityPolicy::checkMethodAllowed() u
Improper neutralization of special elements used in a template engine in the CDK generator in...
CVE-2026-85654
Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mc
Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might allow a context-dependent act...
CVE-2026-85654
Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mc