CVE-2026-68518

Glances ≤ 4.5.5 has a command injection bypass in its action-template sanitizer. The function _sanitize_mustache_dict() in glances/actions.py strips shell operators (&&, |, >>, >) from each Mustache value individually before rendering, but does not strip a lone &. When an administrator-c...

CVE-2026-68518 Glances: Command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, sanitizemustachedict in glances/actions.py sanitizes individual Mustache values before chevron.render, allowing adjacent unescaped Mustache variables to reconstruct shell operators that securepopen executes when...

CVE-2026-68518 Glances: Command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, sanitizemustachedict in glances/actions.py sanitizes individual Mustache values before chevron.render, allowing adjacent unescaped Mustache variables to reconstruct shell operators that securepopen executes when...

CVE-2026-75003

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url in a FuncIRI attribute of an SVG image could evade the remote image blocking, which may lead to information disclosure or privilege escalation...

Security Bulletin: IBM Operations Analytics - Log Analysis is affected by an Improper Serialization due to Apache Log4j JSON Template Layout

Summary Apache Log4j JSON Template Layout in Apache Solr is used by IBM Operations Analytics - Log Analysis as part of the encoding log events. CVE-2026-34481. Vulnerability Details CVEID:CVE-2026-34481 DESCRIPTION: Apache Log4j's JsonTemplateLayout...

CVE-2026-16268

creationtimestamp| type| source ---|---|--- 2026-08-17 06:00:05+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-16268.yaml 2026-08-18 00:00:03+00:00| confirmed|...

CVE-2026-6854

creationtimestamp| type| source ---|---|--- 2026-08-17 03:00:06+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-6854.yaml 2026-08-18 00:00:04+00:00| confirmed|...

PT-2026-76714

Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.6 Description An issue exists in the action system where an administrator can configure shell commands to run when monitoring thresholds are crossed. These commands use Mustache templates that are filled with...

CVE-2026-38165

CVE-2026-38165 is a Critical (CVSS 9.8) Server-Side Template Injection (SSTI) vulnerability in OpenSAGRES XDocReport versions 0.9.2 through 2.2.0 , specifically in the fr.opensagres.xdocreport.template.velocity component. When processing DOCX templates with the Apache Velocity engine, a crafted t...

CVE-2026-38165

A Server-Side Template Injection SSTI vulnerability in the Velocity template engine configuration of xdocreport v0.9.2 to v2.2.0 allows attackers to execute arbitrary code via a crafted expression...

CVE-2026-38165

A Server-Side Template Injection SSTI vulnerability in the Velocity template engine configuration of xdocreport v0.9.2 to v2.2.0 allows attackers to execute arbitrary code via a crafted expression...

PT-2026-76812

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, an authenticated administrator with Applet Host management and deployment permissions can inject Jinja2 expressions into the IP/Host field or Core Service Address field, causing...

PT-2026-76779

Name of the Vulnerable Software and Affected Versions FreeCAD versions 0.19 through 1.1.0 Description In the BIM Project Manager Load Template flow within src/Mod/BIM/bimcommands/BimProjectManager.py, the software passes attacker-controlled FCStd Meta property values for wpposition, wpu, wpv, and...

CVE-2026-74791

Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earli...

CVE-2026-74794

Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit property defaults to unlimited. Attackers can supply circular reference objects to the template context, exhausting stack space and triggering an uncatchable StackOverflowException...

CVE-2026-74789

Scriban before 7.0.0 affected = 6.6.0 applies its LoopLimit constraint only to script loop statements and not to expensive iteration performed inside built-in operators and functions. As a result, a single expression such as 1..1000000 | array.size — or a memory-amplification expression such as '...

CVE-2026-74783

Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with deeply nested parentheses, array initializers, object initializers, or unary operators to trigger ...

CVE-2026-74786

Scriban before 7.0.0 affected versions = 6.6.0 contains a denial-of-service vulnerability in which the LimitToString safety limit default 1MB can be bypassed because ObjectToString resets the per-call length counter currentToStringLength on every top-level call and StringBuilderOutput enforces no...

CVE-2026-73061

Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that allows template code to write CLR object properties without setter-visibility checks. Attackers can modify properties with private, internal, or init-only setters, and perform mass assignment on...

CVE-2026-74794 Scriban before 6.6.0 Denial of Service via Infinite Recursion

Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit property defaults to unlimited. Attackers can supply circular reference objects to the template context, exhausting stack space and triggering an uncatchable StackOverflowException...