Insufficient sanitization of Dashboards in Guardian/CMC before 26.3.0

Summary A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. Impact An authenticated user with the required privileges can define a dashboard containing a malicious payload, or a victim can be socially engineered into...

CVE-2026-33387: Improper Neutralization of Special Elements Used in a Template Engine

A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated user with the required privileges can define a dashboard containing a malicious payload, or a victim can be socially engineered into importing a...

PT-2026-87070

A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated user with the required privileges can define a dashboard containing a malicious payload, or a victim can be socially engineered into importing a...

Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code...

CVE-2026-75650

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue...

CVE-2026-75650 Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue...

EUVD-2026-72530

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue...

CVE-2026-86484

In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS...

CVE-2026-86484

In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS...

EUVD-2026-72500

In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS...

CVE-2026-86484

JetBrains YouTrack before version 2026.2.18634 is vulnerable to a stored cross-site scripting (XSS) flaw caused by AngularJS template injection in assignee names. An authenticated user (low privileges) can craft a malicious assignee name that, when viewed by another user, executes arbitrary scrip...

CVE-2026-86484

In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS...

Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

Summary IBM Enterprise Build of Quarkus is affected by vulnerabilities in Spring Web integration, Qute, OIDC, RESTEasy and SmallRye GraphQL Vulnerability Details CVEID:CVE-2026-19651 DESCRIPTION: Quarkus quarkus-spring-web extension could allow an attacker to bypass authorization by manipulating...

CVE-2026-86484: Improper Neutralization of Input During Web Page Generation

In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS...

VulnCheck KEV: CVE-2026-75650

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue...

PT-2026-86856

In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS...

EUVD-2026-71946

Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates including instance-wide defaults. Attackers can inject malicious container configurations with privileged settings or host path mounts th...

CVE-2026-52762 YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki Bazar contains a stored Server-Side Template Injection SSTI vulnerability in the semantic template feature that can be escalated to confirmed Remote Code Execution RCE. An authenticated administrator can place arbitrary Twig...

CVE-2026-52762 YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki Bazar contains a stored Server-Side Template Injection SSTI vulnerability in the semantic template feature that can be escalated to confirmed Remote Code Execution RCE. An authenticated administrator can place arbitrary Twig...

EUVD-2026-71797

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki Bazar contains a stored Server-Side Template Injection SSTI vulnerability in the semantic template feature that can be escalated to confirmed Remote Code Execution RCE. An authenticated administrator can place arbitrary Twig...