PT-2026-64371

Name of the Vulnerable Software and Affected Versions Microweber CMS versions prior to 2.0.21 Description Authenticated administrators can achieve arbitrary OS command execution by injecting Twig expressions into mail templates. This occurs because the Twig environment in the TwigView::render...

CVE-2026-47722

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/configgen/generator.go:86,108,119 interpolates the operator-supplied ListenHost and TunDevice fields raw into a text/template that produces the agent's config.yml...

CVE-2026-47752

Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2 are vulnerable to Server-Side Template Injection SSTI in the notification template feature. The titletemplate and bodytemplate fields are rendered using an unsandboxed jinja2.Environment, allowing...

CVE-2026-47752 Tugtainer has Server-Side Template Injection in notification templates that leads to Remote Code Execution

Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2 are vulnerable to Server-Side Template Injection SSTI in the notification template feature. The titletemplate and bodytemplate fields are rendered using an unsandboxed jinja2.Environment, allowing...

CVE-2026-47752

Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2 are vulnerable to Server-Side Template Injection SSTI in the notification template feature. The titletemplate and bodytemplate fields are rendered using an unsandboxed jinja2.Environment, allowing...

CVE-2026-65900

DOMPurify versions =3.0.0 and before 3.4.8, when configured with SAFEFORTEMPLATES together with a DOM output mode RETURNDOM, RETURNDOMFRAGMENT, or INPLACE, fail to strip template expressions e.g. $evil, evil, inside element content. The final normalization/scrub pass scrubTemplateExpressions uses...

EUVD-2026-48269

DOMPurify versions =3.0.0 and before 3.4.8, when configured with SAFEFORTEMPLATES together with a DOM output mode RETURNDOM, RETURNDOMFRAGMENT, or INPLACE, fail to strip template expressions e.g. $evil, evil, inside element content. The final normalization/scrub pass scrubTemplateExpressions uses...

CVE-2026-65900

DOMPurify versions =3.0.0 and before 3.4.8, when configured with SAFEFORTEMPLATES together with a DOM output mode RETURNDOM, RETURNDOMFRAGMENT, or INPLACE, fail to strip template expressions e.g. $evil, evil, inside element content. The final normalization/scrub pass scrubTemplateExpressions uses...

CVE-2026-65900 DOMPurify before 3.4.8 Template Expression Injection via RETURN_DOM

DOMPurify versions =3.0.0 and before 3.4.8, when configured with SAFEFORTEMPLATES together with a DOM output mode RETURNDOM, RETURNDOMFRAGMENT, or INPLACE, fail to strip template expressions e.g. $evil, evil, inside element content. The final normalization/scrub pass scrubTemplateExpressions uses...

CVE-2026-65900

CVE-2026-65900 affects DOMPurify versions 3.0.0 up to 3.4.7 when configured with SAFE_FOR_TEMPLATES and a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE). The final scrub pass (_scrubTemplateExpressions) uses a NodeIterator and node.normalize() that do not descend into template.con...

CVE-2026-65900 DOMPurify before 3.4.8 Template Expression Injection via RETURN_DOM

DOMPurify versions =3.0.0 and before 3.4.8, when configured with SAFEFORTEMPLATES together with a DOM output mode RETURNDOM, RETURNDOMFRAGMENT, or INPLACE, fail to strip template expressions e.g. $evil, evil, inside element content. The final normalization/scrub pass scrubTemplateExpressions uses...

CVE-2026-65605 SiYuan before v3.7.2 Stored XSS to RCE via Attribute View

SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View database cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, and EscapeHTML is only applied when HasUnclosedHtmlTag returns true; because balanced...

CVE-2026-65605 SiYuan before v3.7.2 Stored XSS to RCE via Attribute View

SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View database cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, and EscapeHTML is only applied when HasUnclosedHtmlTag returns true; because balanced...

EUVD-2026-48241

SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View database cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, and EscapeHTML is only applied when HasUnclosedHtmlTag returns true; because balanced...

PYSEC-2026-3505 PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml

Summary PraisonAI recipe execution has a dangerous-tool policy that is supposed to block default-denied tools unless the caller explicitly passes allowdangeroustools=True. That policy only checks tools declared in TEMPLATE.yaml requires.tools. For steps-based recipes, the actual execution path...

PYSEC-2026-3509 PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion

Summary PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/[email protected]. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into /.praison/cache/templates/github//// without...

Astra Linux – Vulnerability in Chromium

Integer overflow in WTF in Google Chrome prior to version 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-15404

The Lpagery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.5.7. This is due to insufficient input sanitization and output escaping in the lpageryaddfiltertexttemplatepost function, which is hooked to adminfooter and echoes the...

CVE-2026-15404 Bulk Page Generator <= 2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title

The Lpagery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.5.7. This is due to insufficient input sanitization and output escaping in the lpageryaddfiltertexttemplatepost function, which is hooked to adminfooter and echoes the...

CVE-2026-15404

CVE-2026-15404 concerns the Lpagery WordPress plugin (&lt;= 2.5.7). It enables a Stored Cross-Site Scripting (XSS) via post titles due to insufficient sanitization and output escaping in lpagery_add_filter_text_template_post(), which runs on admin_footer and echoes the raw post_title of the post ...