PT-2026-96130

Name of the Vulnerable Software and Affected Versions GoCD versions 18.7.0 through 26.0.x Description The Get Template Config API compares HTTP method names case-sensitively when selecting authorization filters. This allows an authenticated user with low privileges to bypass view permission...

CVE-2026-52740: Incorrect Authorization

GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when selecting authorization filters. A lower-privileged authenticated user can send a request with nonstandard HTTP method capitalization to retrieve a pipeline...

RHEL 9 : rhc (RHSA-2026:69104)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:69104 advisory. rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management. Security...

CVE-2026-94047 samanhappy MCPHub Template Import Endpoint templateService.ts importTemplate privileges management

A security vulnerability has been detected in samanhappy MCPHub up to 1.0.32. The impacted element is the function importTemplate of the file src/services/templateService.ts of the component Template Import Endpoint. The manipulation leads to improper privilege management. Remote exploitation of...

CVE-2026-94047

samanhappy MCPHub (up to version 1.0.32) is affected by an improper privilege management flaw in the Template Import Endpoint , specifically the importTemplate function within src/services/templateService.ts. The vulnerability is remotely exploitable over the network with low complexity and low p...

CVE-2026-94109 openEQUELLA < 2026.1.0 Authenticated Stored SSTI via FreemarkerPortletRenderer

openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml that allows any authenticated non-guest user to achieve remote code execution by storing a malicious FreeMarker payload through a POST request to the...

CVE-2026-94109 openEQUELLA < 2026.1.0 Authenticated Stored SSTI via FreemarkerPortletRenderer

openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml that allows any authenticated non-guest user to achieve remote code execution by storing a malicious FreeMarker payload through a POST request to the...

PT-2026-96004

Name of the Vulnerable Software and Affected Versions samanhappy MCPHub versions prior to 1.0.33 Description Improper privilege management exists within the Template Import Endpoint. The issue resides in the importTemplate function located in the src/services/templateService.ts file, allowing for...

CVE-2026-94109: Improper Neutralization of Special Elements Used in a Template Engine

openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml that allows any authenticated non-guest user to achieve remote code execution by storing a malicious FreeMarker payload through a POST request to the...

CVE-2026-93985

OpenPanel js-runtime through 2.3.0 contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webhook templates using computed property notation to access...

CVE-2026-93985

OpenPanel js-runtime through commit bad75bdd is affected by a sandbox escape in its JavaScript webhook template validator . The validator fails to block computed member access to constructor chains, allowing attackers with project write access to craft webhook templates using computed property no...

CVE-2026-93985 OpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCE

OpenPanel js-runtime through 2.3.0 contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webhook templates using computed property notation to access...

CVE-2026-93985 OpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCE

OpenPanel js-runtime through 2.3.0 contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webhook templates using computed property notation to access...

CVE-2026-93985 OpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCE

OpenPanel js-runtime through 2.3.0 contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webhook templates using computed property notation to access...

CVE-2026-9855

The Custom Field Template plugin for WordPress is vulnerable to generic SQL Injection via the 'postID' parameter in all versions up to, and including, 2.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

EUVD-2026-83557

The Custom Field Template plugin for WordPress is vulnerable to generic SQL Injection via the 'postID' parameter in all versions up to, and including, 2.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-9855 Custom Field Template <= 2.7.8 - Authenticated (Contributor+) SQL Injection via 'post_ID' Parameter

The Custom Field Template plugin for WordPress is vulnerable to generic SQL Injection via the 'postID' parameter in all versions up to, and including, 2.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-9855

The Custom Field Template plugin for WordPress is vulnerable to generic SQL Injection via the post_ID parameter in all versions up to and including 2.7.8 . The root cause is insufficient escaping on the user-supplied parameter and lack of preparation on the existing SQL query. The capability chec...

CVE-2026-9855 Custom Field Template <= 2.7.8 - Authenticated (Contributor+) SQL Injection via 'post_ID' Parameter

The Custom Field Template plugin for WordPress is vulnerable to generic SQL Injection via the 'postID' parameter in all versions up to, and including, 2.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CLEANSTART-2026-ST98100 JinJava is a Java-based template engine based on django template syntax, adapted to render jinja templates

Security vulnerability affects the wso2am package. JinJava is a Java-based template engine based on django template syntax, adapted to render jinja templates...