Linux Distros Unpatched Vulnerability : CVE-2026-105315

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function topython of the file haystack/backends/elasticsearchbackend.py of the...

DEBIAN-CVE-2026-105315

A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function topython of the file haystack/backends/elasticsearchbackend.py of the component morelikethis Template Tag Handler. Such manipulation of the argument resultclass leads to improper neutralization of directives i...

CVE-2026-105315

A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function topython of the file haystack/backends/elasticsearchbackend.py of the component morelikethis Template Tag Handler. Such manipulation of the argument resultclass leads to improper neutralization of directives i...

CVE-2026-105315 django-haystack more_like_this Template Tag elasticsearch_backend.py _to_python eval injection

A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function topython of the file haystack/backends/elasticsearchbackend.py of the component morelikethis Template Tag Handler. Such manipulation of the argument resultclass leads to improper neutralization of directives i...

CVE-2026-105315 django-haystack more_like_this Template Tag elasticsearch_backend.py _to_python eval injection

A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function topython of the file haystack/backends/elasticsearchbackend.py of the component morelikethis Template Tag Handler. Such manipulation of the argument resultclass leads to improper neutralization of directives i...

CVE-2026-105315

A vulnerability exists in django-haystack versions up to 3.3.0 within the more_like_this Template Tag Handler. Specifically, the _to_python function in haystack/backends/elasticsearch_backend.py is susceptible to eval injection (CWE-95, CWE-94) because manipulation of the result_class argument le...

EUVD-2026-92429

A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function topython of the file haystack/backends/elasticsearchbackend.py of the component morelikethis Template Tag Handler. Such manipulation of the argument resultclass leads to improper neutralization of directives i...

CVE-2026-105315 django-haystack more_like_this Template Tag elasticsearch_backend.py _to_python eval injection

A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function topython of the file haystack/backends/elasticsearchbackend.py of the component morelikethis Template Tag Handler. Such manipulation of the argument resultclass leads to improper neutralization of directives i...

CVE-2026-105315: Improper Neutralization of Directives in Dynamically Evaluated Code

A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function topython of the file haystack/backends/elasticsearchbackend.py of the component morelikethis Template Tag Handler. Such manipulation of the argument resultclass leads to improper neutralization of directives i...

PT-2026-105984

A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function to python of the file haystack/backends/elasticsearch backend.py of the component more like this Template Tag Handler. Such manipulation of the argument result class leads to improper neutralization of...

CVE-2026-71232

MacCMS10's admin template editor application/admin/controller/Template.php blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, showsource, createfunction, registershutdownfunction, registertickfunction, and errorlog. Combined...

CVE-2026-71232 MacCMS10 - Incomplete Function Blacklist in Template Editor Enables Authenticated RCE

MacCMS10's admin template editor application/admin/controller/Template.php blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, showsource, createfunction, registershutdownfunction, registertickfunction, and errorlog...

PYSEC-2026-2279

Slippers is a UI component framework for Django. Prior to version 0.6.3, a Cross-Site Scripting XSS vulnerability exists in the % attrs % template tag of the slippers Django package. When a context variable containing untrusted data is passed to % attrs %, the value is interpolated into an HTML...

CVE-2026-34231 Slippers: Cross-Site Scripting (XSS) in `attrs` Template Tag

Slippers is a UI component framework for Django. Prior to version 0.6.3, a Cross-Site Scripting XSS vulnerability exists in the % attrs % template tag of the slippers Django package. When a context variable containing untrusted data is passed to % attrs %, the value is interpolated into an HTML...

CVE-2026-34231: Improper Neutralization of Input During Web Page Generation

Slippers is a UI component framework for Django. Prior to version 0.6.3, a Cross-Site Scripting XSS vulnerability exists in the % attrs % template tag of the slippers Django package. When a context variable containing untrusted data is passed to % attrs %, the value is interpolated into an HTML...

Cross-site Scripting (XSS)

Overview slippers is a Build reusable components in Django without writing a single line of Python. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the attrstring function of the % attrs % template tag, which fails to escape user-supplied values interpolated into...

Slippers Vulnerable to Cross-Site Scripting (XSS) in `attrs` Template Tag

Summary A Cross-site Scripting XSS vulnerability exists in the % attrs % template tag of the slippers Django package. When a context variable containing untrusted data is passed to % attrs %, the value is interpolated into an HTML attribute string without escaping, allowing an attacker to break o...

GHSA-W7RV-GFP4-J9J3 Slippers Vulnerable to Cross-Site Scripting (XSS) in `attrs` Template Tag

Summary A Cross-site Scripting XSS vulnerability exists in the % attrs % template tag of the slippers Django package. When a context variable containing untrusted data is passed to % attrs %, the value is interpolated into an HTML attribute string without escaping, allowing an attacker to break o...

WordPress Ultimate Member plugin <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag vulnerability

Authenticated Contributor+ Sensitive Information Exposure to Account Takeover via Shortcode Template Tag vulnerability discovered by HDH - FPT Software in WordPress Plugin Ultimate Member versions = 2.11.2...

PT-2026-29160

Name of the Vulnerable Software and Affected Versions Slippers versions prior to 0.6.3 Description A Cross-Site Scripting XSS issue exists in the % attrs % template tag of the Slippers Django package. When a context variable containing untrusted data is passed to % attrs %, the value is...