Lucene search
+L

16530 matches found

UbuntuCve
UbuntuCve
added 2026/07/14 10:17 p.m.14 views

CVE-2026-48806

Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allowing PHP to invoke toString on a Stringable object used as a mapping key without calling SandboxExtension::ensureToStringAllowed. This issue is fixed in versi...

9.1CVSS6.1AI score0.00234EPSS
SaveExploits0References2
NVD
NVD
added 2026/07/14 10:16 p.m.7 views

CVE-2026-46640

Twig is a template language for PHP. From 3.15.0 until 3.26.0, self. and import-alias dynamic attribute syntax can concatenate an attacker-controlled string into a MacroReferenceExpression name without identifier validation, causing raw PHP to be emitted into the generated template source and...

8.8CVSS0.00405EPSS
SaveExploits0References3
OSV
OSV
added 2026/07/14 9:28 p.m.5 views

CVE-2026-48806 Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys

Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allowing PHP to invoke toString on a Stringable object used as a mapping key without calling SandboxExtension::ensureToStringAllowed. This issue is fixed in versi...

7.1CVSS6.1AI score0.00234EPSS
SaveExploits0References5
CVE
CVE
added 2026/07/14 9:28 p.m.36 views

CVE-2026-48806

Twig (PHP) prior to 3.27.0 is vulnerable to a Sandbox __toString() policy bypass via dynamic mapping keys in ArrayExpression. The issue allows a Stringable object used as a mapping key to invoke its __toString() without SandboxExtension::ensureToStringAllowed(), enabling potential data exposure a...

9.1CVSS6.1AI score0.00234EPSS
SaveExploits0References3Affected Software1
Cvelist
Cvelist
added 2026/07/14 9:28 p.m.40 views

CVE-2026-48806 Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys

Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allowing PHP to invoke toString on a Stringable object used as a mapping key without calling SandboxExtension::ensureToStringAllowed. This issue is fixed in versi...

7.1CVSS0.00234EPSS
SaveExploits0References3
Debian CVE
Debian CVE
added 2026/07/14 9:28 p.m.12 views

CVE-2026-48806

Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allowing PHP to invoke toString on a Stringable object used as a mapping key without calling SandboxExtension::ensureToStringAllowed. This issue is fixed in versi...

9.1CVSS5.4AI score0.00234EPSS
SaveExploits0
Debian CVE
Debian CVE
added 2026/07/14 9:22 p.m.10 views

CVE-2026-46640

Twig is a template language for PHP. From 3.15.0 until 3.26.0, self. and import-alias dynamic attribute syntax can concatenate an attacker-controlled string into a MacroReferenceExpression name without identifier validation, causing raw PHP to be emitted into the generated template source and...

8.8CVSS5.3AI score0.00405EPSS
SaveExploits0
CVE
CVE
added 2026/07/14 9:12 p.m.31 views

CVE-2026-47732

Twig Sandbox: multiple __toString() policy bypasses via unguarded string coercion points existed prior to 3.26.0, enabling string coercion of Stringable operands through various constructs (conditional expressions, matches operator, loose comparisons, tests, template-loading tags, dynamic attribu...

7.1CVSS6.1AI score0.0036EPSS
SaveExploits0References3Affected Software1
Snyk
Snyk
added 2026/07/14 6:47 p.m.7 views

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the POJOPropertiesCollector.removeUnwantedIgnorals process. An attacker can access or modify properties that were intended to be ignored by supplying JSON...

6.9CVSS6.1AI score0.00247EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/07/14 6:32 p.m.8 views

EUVD-2026-44117

Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network...

9.8CVSS6.3AI score0.11058EPSS
SaveExploits0References2
NVD
NVD
added 2026/07/14 5:16 p.m.8 views

CVE-2026-49181

Integer underflow wrap or wraparound in Windows DHCP Client allows an unauthorized attacker to elevate privileges over a network...

9.8CVSS0.00794EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/14 5:16 p.m.7 views

CVE-2026-48564

Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over a network...

8.8CVSS0.00763EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/14 5:10 p.m.23 views

CVE-2026-58627

CVE-2026-58627 is a Windows DHCP Server Denial of Service vulnerability caused by uncontrolled resource consumption that allows a remote attacker to deny service over a network. Affected: Windows DHCP Server. Impact: availability loss (high). Mitigation: Microsoft has released updates and guidanc...

7.5CVSS6.1AI score0.00871EPSS
SaveExploits0References1Affected Software7
EUVD
EUVD
added 2026/07/14 5:9 p.m.5 views

EUVD-2026-44234

Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network...

9.8CVSS6.3AI score0.00996EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/14 5:9 p.m.33 views

CVE-2026-56159

CVE-2026-56159 is a heap-based buffer overflow in Windows DHCP Server that can allow an unauthenticated attacker to execute code over a network (remote code execution). The vulnerability is rated CRITICAL with Network attack vector and no explicit exploit details in the provided documents. Connec...

9.8CVSS6.3AI score0.00996EPSS
SaveExploits0References1Affected Software7
EUVD
EUVD
added 2026/07/14 5:8 p.m.7 views

EUVD-2026-44149

Use after free in Windows DHCP Client allows an unauthorized attacker to execute code locally...

8.4CVSS6.1AI score0.00301EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/07/14 5:8 p.m.7 views

CVE-2026-54128 Windows DHCP Client Remote Code Execution Vulnerability

...

8.4CVSS6.1AI score0.00301EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/14 5:6 p.m.40 views

CVE-2026-50370 DHCP Server Service Remote Code Execution Vulnerability

...

8.8CVSS0.00494EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/14 5:6 p.m.15 views

CVE-2026-50370

CVE-2026-50370 is a heap-based buffer overflow in the Windows DHCP Server service that could allow an unauthenticated attacker on an adjacent network to execute code. The vulnerability is listed among the July 2026 Patch Tuesday disclosures and is included in Microsoft’s security updates (KB50995...

8.8CVSS6.3AI score0.00494EPSS
SaveExploits0References1Affected Software7
Vulnrichment
Vulnrichment
added 2026/07/14 5:6 p.m.9 views

CVE-2026-50370 DHCP Server Service Remote Code Execution Vulnerability

...

8.8CVSS6.1AI score0.00494EPSS
SaveExploits0References1
Rows per page
Query Builder