CVE-2026-81924 Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Theme Page Template Activation

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery CSRF in the theme page-template activation feature. The Dashboard theme Inspect controller's activatefiles action created PageTemplate records from attacker-supplied pageTemplates values without validating an anti-CSRF token.A...

CVE-2026-91925 Polyaxon through 2.16.4 Server-Side Template Injection via Unsandboxed Jinja2 Engine

Polyaxon through 2.16.4 renders operation specification fields with an unsandboxed Jinja2 environment during server-side run preparation, allowing authenticated users to execute arbitrary code. Attackers can submit runs with Jinja2 payloads in queue, namespace, conditions, presets, or dependencie...

EUVD-2026-78416

Polyaxon through 2.16.4 renders operation specification fields with an unsandboxed Jinja2 environment during server-side run preparation, allowing authenticated users to execute arbitrary code. Attackers can submit runs with Jinja2 payloads in queue, namespace, conditions, presets, or dependencie...

CVE-2026-52828 Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access

Kimai is an open-source time tracking application. Prior to 2.58.0, ExportController::createExportTemplate and ExportController::editExportTemplate inherit only the class-level createexport permission, which ROLETEAMLEAD receives by default, and omit the createexporttemplate permission required b...

CVE-2026-59341

A security vulnerability exists in the Sealed Secrets controller's unauthenticated POST endpoints. By submitting a modified payload containing custom Go template logic in spec.template.data, an attacker with internal network access can abuse the handler as a decryption oracle to recover the full...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

EUVD-2026-78349

A security vulnerability exists in the Sealed Secrets controller's unauthenticated POST endpoints. By submitting a modified payload containing custom Go template logic in spec.template.data, an attacker with internal network access can abuse the handler as a decryption oracle to recover the full...

CVE-2026-59341

Sealed Secrets controller (Bitnami) is vulnerable to a decryption oracle via Go template injection in its unauthenticated POST /v1/verify and /v1/rotate endpoints. The root cause is a missing AEAD label binding : the spec.template.data field is excluded from the authenticated-data label, letting ...

CVE-2026-59341 Sealed Secrets: decryption oracle via Go template injection in unauthenticated controller endpoints

A security vulnerability exists in the Sealed Secrets controller's unauthenticated POST endpoints. By submitting a modified payload containing custom Go template logic in spec.template.data, an attacker with internal network access can abuse the handler as a decryption oracle to recover the full...

CVE-2026-59341 Sealed Secrets: decryption oracle via Go template injection in unauthenticated controller endpoints

A security vulnerability exists in the Sealed Secrets controller's unauthenticated POST endpoints. By submitting a modified payload containing custom Go template logic in spec.template.data, an attacker with internal network access can abuse the handler as a decryption oracle to recover the full...

CVE-2026-59341 Sealed Secrets: decryption oracle via Go template injection in unauthenticated controller endpoints

A security vulnerability exists in the Sealed Secrets controller's unauthenticated POST endpoints. By submitting a modified payload containing custom Go template logic in spec.template.data, an attacker with internal network access can abuse the handler as a decryption oracle to recover the full...

CVE-2026-62382

creationtimestamp| type| source ---|---|--- 2026-09-15 09:00:05+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-62382.yaml 2026-09-16 00:00:03+00:00| confirmed|...

CVE-2026-90878

A vulnerability was determined in vllm-project vLLM up to 0.27.1. This affects an unknown part of the file /v1/chat/completions of the component Jinja Template Rendering. This manipulation of the argument chattemplate causes resource consumption. The attack can be initiated remotely. The exploit...

CVE-2026-90878

A flaw was found in vllm-project vLLM. A remote attacker could exploit a vulnerability in the Jinja Template Rendering component by manipulating the chattemplate argument. This manipulation leads to excessive resource consumption, potentially causing a Denial of Service DoS condition for the...

CVE-2026-90878

vLLM (vllm-project) versions up to 0.27.1 are affected by a resource consumption vulnerability in the Jinja Template Rendering component of the /v1/chat/completions endpoint. The root cause is manipulation of the chat_template argument, allowing a remote attacker with low privileges to trigger ex...

CVE-2026-90878 vllm-project vLLM Jinja Template Rendering completions resource consumption

A vulnerability was determined in vllm-project vLLM up to 0.27.1. This affects an unknown part of the file /v1/chat/completions of the component Jinja Template Rendering. This manipulation of the argument chattemplate causes resource consumption. The attack can be initiated remotely. The exploit...

EUVD-2026-78268

A vulnerability was determined in vllm-project vLLM up to 0.27.1. This affects an unknown part of the file /v1/chat/completions of the component Jinja Template Rendering. This manipulation of the argument chattemplate causes resource consumption. The attack can be initiated remotely. The exploit...