CVE-2026-49867 DataEase: Authenticated Stored XSS in DataEase Template Static Resources

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase template static resources let authenticated users submit TemplateManageRequest.staticResource through POST /de2api/templateManage/save or DataVisualizationServer.decompression, after which...

CVE-2026-45419

DataEase contains an arbitrary file write vulnerability present before version 2.10.23. The flaw resides in template handling: the TemplateManageService#save, StaticResourceServer#saveFilesToServe methods and the /de2api/templateManage/save endpoint accept attacker-controlled staticResource names...

CVE-2026-45419 DataEase: Arbitrary File Write Vulnerability

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase template saves call TemplateManageServicesave, StaticResourceServersaveFilesToServe, and the /de2api/templateManage/save endpoint with attacker-controlled staticResource names and Base64 content, allowing...

CVE-2026-55242

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, an authenticated user with a standard operational role can trigger server-side template injection through a configuration field, resulting in unauthorized disclosure of data outside the user's norm...

EUVD-2026-44704

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, an authenticated user with a standard operational role can trigger server-side template injection through a configuration field, resulting in unauthorized disclosure of data outside the user's norm...

CVE-2026-55242 ERPNext: Server-Side Template Injection (SSTI) in Batch autonaming via Stock Settings.naming_series_prefix

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, an authenticated user with a standard operational role can trigger server-side template injection through a configuration field, resulting in unauthorized disclosure of data outside the user's norm...

CVE-2026-55242

CVE-2026-55242 affects ERPNext prior to 15.111.0 and 16.22.0, where an authenticated user with a standard operational role can trigger a server-side template injection via a configuration field in Batch autonaming (Stock Settings.naming_series_prefix). This leads to unauthorized disclosure of dat...

CVE-2026-55242 ERPNext: Server-Side Template Injection (SSTI) in Batch autonaming via Stock Settings.naming_series_prefix

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, an authenticated user with a standard operational role can trigger server-side template injection through a configuration field, resulting in unauthorized disclosure of data outside the user's norm...

Security update for go1.25-openssl

This update for go1.25-openssl fixes the following issues Update to version go1.25.12 bsc1244485. CVE-2026-25679: net/url: reject IPv6 literal not at start of host bsc1259264. CVE-2026-27139: os: FileInfo can escape from a Root bsc1259268. CVE-2026-27142: html/template: URLs in meta content...

SUSE-SU-2026:3046-1 Security update for go1.25-openssl

This update for go1.25-openssl fixes the following issues - Update to version go1.25.12 bsc1244485. - CVE-2026-25679: net/url: reject IPv6 literal not at start of host bsc1259264. - CVE-2026-27139: os: FileInfo can escape from a Root bsc1259268. - CVE-2026-27142: html/template: URLs in meta conte...

CVE-2026-46635

A flaw was found in Twig, a template language for PHP. An untrusted template author, with the column filter in their allowed filters, can exploit this vulnerability. The column filter incorrectly passes object arrays to PHP's arraycolumn function, which can read properties that are not restricted...

CVE-2026-48808

A flaw was found in Twig, a template language for PHP. The column filter in Twig fails to properly forward the active sandbox state, specifically the current Source to the SandboxExtension::checkPropertyAllowed function. This oversight results in the loss of SourcePolicyInterface decisions,...

CVE-2026-48806

A flaw was found in Twig, a template language for PHP. This vulnerability allows a remote attacker to bypass security restrictions by providing specially crafted input. Successful exploitation can lead to the disclosure of sensitive information and potentially allow for limited unauthorized data...

CVE-2026-46633

A flaw was found in Twig, a template language for PHP. This vulnerability occurs because the Compiler::string function does not properly escape single quotes when processing a template name from a % use % tag within a PHP single-quoted string literal. A remote attacker could craft a malicious...

CVE-2026-49981

A flaw was found in Twig, a template language for PHP. An attacker with low privileges could exploit a caching issue in the template sandboxing mechanism. This allows a sandboxed template to bypass its intended security policy, potentially leading to unauthorized information disclosure and limite...

CVE-2026-46639

A flaw was found in Twig, a template language for PHP. An attacker with write access to a sandboxed Twig template can bypass security restrictions due to an issue in object-destructuring assignment. This allows them to read public properties or invoke public methods on objects, leading to...

CVE-2026-46638

A flaw was found in Twig, a template language for PHP. A security vulnerability exists where a template included within a restricted sandbox environment can bypass security checks if it was previously loaded without these restrictions. This allows the template to execute unauthorized functions,...

CVE-2026-48807

A flaw was found in Twig, a template language for PHP. The security sandbox, designed to restrict operations, does not properly handle certain values when processing templates. This oversight could allow an attacker to bypass security policies, potentially leading to the disclosure of sensitive...

CVE-2026-47732

A flaw was found in Twig, a template language for PHP. This vulnerability allows a sandboxed template author to bypass security policies by triggering PHP string coercion on specific language constructs. This can lead to information disclosure, as an attacker may be able to invoke toString on...

CVE-2026-58655

The bundled Grav Flex Objects plugin getgrav/grav-plugin-flex-objects before 1.4.0 contains a stored server-side template injection vulnerability. When rendering dynamic collection or object titles, the plugin passes user-controlled frontmatter values page.header.flex.collection.title or...