EUVD-2026-93376

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocachehash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied...

CVE-2026-82531

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocachehash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied...

PT-2026-106715

Name of the Vulnerable Software and Affected Versions Smarty versions prior to 4.5.8 Smarty versions 5.x prior to 5.8.5 Description A code injection flaw exists during multi-component template inheritance where the top-level nocache hash is not restored and remains null. This allows an attacker t...

PYSEC-2026-4037 djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags

Impact Many djust built-in component template tags djust.components.templatetags. render a developer/user-supplied URL into an href / action attribute, HTML-escaping it with conditionalescape but never validating the URL scheme. HTML escaping prevents attribute breakout but does not neutralize a...

djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags

ImpactMany djust built-in component template tags djust.components.templatetags. render a developer/user-supplied URL into an href / action attribute, HTML-escaping it with conditionalescape but never validating the URL scheme. HTML escaping prevents attribute breakout but does not neutralize a...

CVE-2026-61597

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, many djust built-in component template tags "djust.components.templatetags." render a developer/user-supplied URL into an "href" / "action" attribute, HTML-escapi...

Exploit for Eval Injection in Langflow

Description Usage python3 poc.py -u -c Without...

JreCMS security vulnerabilities

JreCMS is a website builder from JreCMS Inc. A security vulnerability exists in JreCMS that stems from some unknown functionality in the component template management...