CVE-2026-18632

CVE-2026-18632 affects langgenius dify up to 1.14.2, specifically the Jinja2 Handler’s jinja2_transformer.py (api/core/helper/code_executor/jinja2/jinja2_transformer.py) and its use of jinja2.Template. The vulnerability arises from improper neutralization of special elements used in the template ...

CVE-2026-67612 OpenEMR 8.2.0 Stored XSS via import_template.php Template Management

OpenEMR through 8.2.0 contains a stored cross-site scripting vulnerability in the patient portal template system that allows authenticated administrators to inject arbitrary HTML and JavaScript by storing malicious payloads through the template save mode, which only filters literal PHP open tags...

CVE-2026-67612

OpenEMR 8.2.0 contains a stored XSS vulnerability in the patient portal template system (import_template.php, Template Management). The root cause is stored payloads in the template save mode, which only filters literal PHP open tags, coupled with lack of output encoding at retrieval and missing ...

CVE-2026-67612 OpenEMR 8.2.0 Stored XSS via import_template.php Template Management

OpenEMR through 8.2.0 contains a stored cross-site scripting vulnerability in the patient portal template system that allows authenticated administrators to inject arbitrary HTML and JavaScript by storing malicious payloads through the template save mode, which only filters literal PHP open tags...

EUVD-2026-52349

OpenEMR through 8.2.0 contains a stored cross-site scripting vulnerability in the patient portal template system that allows authenticated administrators to inject arbitrary HTML and JavaScript by storing malicious payloads through the template save mode, which only filters literal PHP open tags...

p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing

A flaw was found in p11-kit. The RPC message attribute parsing functions p11rpcmessagegetattribute and p11rpcmessagegetattributearrayvalue form a mutually-recursive call chain with no recursion depth limit when processing nested CKAWRAPTEMPLATE, CKAUNWRAPTEMPLATE, and CKADERIVETEMPLATE attributes...

p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing

A flaw was found in p11-kit. The RPC message attribute parsing functions p11rpcmessagegetattribute and p11rpcmessagegetattributearrayvalue form a mutually-recursive call chain with no recursion depth limit when processing nested CKAWRAPTEMPLATE, CKAUNWRAPTEMPLATE, and CKADERIVETEMPLATE attributes...

CVE-2026-69075

FlowIntel is affected by a stored XSS via multiple stored fields that are rendered within Vue templates. An authenticated user can inject Vue interpolation expressions into fields (case/title/ticket/organization/role/profile, etc.). When other users view affected pages, the application may evalua...

CVE-2026-69075 Stored Cross-Site Scripting via Vue Template Injection in FlowIntel

FlowIntel is affected by a stored cross-site scripting vulnerability through multiple user-controlled or administrator-controlled fields. Persisted values—including case titles, ticket identifiers, recurring-case information, user profile attributes, organisation names, and role names—were render...

CVE-2026-69075 Stored Cross-Site Scripting via Vue Template Injection in FlowIntel

FlowIntel is affected by a stored cross-site scripting vulnerability through multiple user-controlled or administrator-controlled fields. Persisted values—including case titles, ticket identifiers, recurring-case information, user profile attributes, organisation names, and role names—were render...

CVE-2026-18592

A security flaw has been discovered in osCommerce 4.14.63493. Affected by this issue is the function EmailController of the file app/lib/backend/controllers/EmailController.php of the component Email Template Configuration. Performing a manipulation of the argument emailtemplateskey results in sq...

CVE-2026-18593

A weakness has been identified in vxcontrol PentAGI up to 2.1.0. This affects an unknown part of the file backend/pkg/templates/prompts/pentester.tmpl of the component Tool Management Protocol Handler. Executing a manipulation can lead to sandbox issue. It is possible to launch the attack remotel...

CVE-2026-18593 vxcontrol PentAGI Tool Management Protocol pentester.tmpl sandbox

A weakness has been identified in vxcontrol PentAGI up to 2.1.0. This affects an unknown part of the file backend/pkg/templates/prompts/pentester.tmpl of the component Tool Management Protocol Handler. Executing a manipulation can lead to sandbox issue. It is possible to launch the attack remotel...

CVE-2026-18593

A weakness has been identified in vxcontrol PentAGI up to 2.1.0. This affects an unknown part of the file backend/pkg/templates/prompts/pentester.tmpl of the component Tool Management Protocol Handler. Executing a manipulation can lead to sandbox issue. It is possible to launch the attack remotel...

EUVD-2026-52222

A weakness has been identified in vxcontrol PentAGI up to 2.1.0. This affects an unknown part of the file backend/pkg/templates/prompts/pentester.tmpl of the component Tool Management Protocol Handler. Executing a manipulation can lead to sandbox issue. It is possible to launch the attack remotel...

CVE-2026-18593

Vulnerability CVE-2026-18593 affects vxcontrol PentAGI up to version 2.1.0. It targets an unknown part of the file backend/pkg/templates/prompts/pentester.tmpl within the Tool Management Protocol Handler. The issue can be exploited remotely to cause sandbox-related problems; exploitation is descr...

EUVD-2026-52221

A security flaw has been discovered in osCommerce 4.14.63493. Affected by this issue is the function EmailController of the file app/lib/backend/controllers/EmailController.php of the component Email Template Configuration. Performing a manipulation of the argument emailtemplateskey results in sq...

CVE-2026-18592 osCommerce Email Template Configuration EmailController.php EmailController sql injection

A security flaw has been discovered in osCommerce 4.14.63493. Affected by this issue is the function EmailController of the file app/lib/backend/controllers/EmailController.php of the component Email Template Configuration. Performing a manipulation of the argument emailtemplateskey results in sq...

CVE-2026-18592

CVE-2026-18592 affects osCommerce version 4.14.63493, specifically the function EmailController in app/lib/backend/controllers/EmailController.php of the Email Template Configuration component. The issue arises from manipulating the email_templates_key argument, which leads to a SQL injection vul...

CVE-2026-18581

A vulnerability was determined in ggml-org llama.cpp e15efe0. Affected by this issue is some unknown functionality of the file common/jinja/parser.cpp of the component Jinja Minja Template Parser. Executing a manipulation with the input 9|9| can lead to reachable assertion. The attack requires...