556 matches found
Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager.
Summary Multiple vulnerabilities were addressed in IBM Sterling Partner Engagement Manager. Vulnerability Details CVEID:CVE-2021-23369 DESCRIPTION: The package handlebars before 4.7.7 are vulnerable to Remote Code Execution RCE when selecting certain compiling options to compile templates coming...
Security Bulletin: MongoDB Enterprised Advanced affected by: Cross-site Scripting (CVE-2026-33916)
Summary There are vulnerabilities in handlebars-4.7.7.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-33916. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-33916 DESCRIPTION: Handlebars provides the power necessary to let users build semantic...
Security Bulletin: MongoDB Enterprised Advanced affected by: Code Injection, Improper Check for Unusual or Exceptional Conditions, Cross-site Scripting (CVE-2026-33937, CVE-2026-33938, CVE-2026-33939, CVE-2026-33940, CVE-2026-33941)
Summary There are vulnerabilities in handlebars-4.7.7.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-33937, CVE-2026-33938, CVE-2026-33939, CVE-2026-33940, CVE-2026-33941. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-33937 DESCRIPTION:...
CVE-2026-16231
hbs , an Express view engine wrapping Handlebars, has a cross-site scripting vulnerability in its registerAsyncHelper API. An async helper returns an opaque placeholder during the first render pass, so Handlebars' double-brace escaping applies only to the placeholder. After rendering, hbs substit...
CVE-2026-16231
hbs is an Express view engine that wraps Handlebars. Its registerAsyncHelper API bypasses Handlebars' automatic HTML escaping: an async helper returns an opaque placeholder during the first render pass, so the double-brace expression escapes only the placeholder, and after rendering hbs substitut...
CVE-2026-16231 hbs vulnerable to XSS via registerAsyncHelper output-escaping bypass
hbs is an Express view engine that wraps Handlebars. Its registerAsyncHelper API bypasses Handlebars' automatic HTML escaping: an async helper returns an opaque placeholder during the first render pass, so the double-brace expression escapes only the placeholder, and after rendering hbs substitut...
CVE-2026-16231: Improper Neutralization of Input During Web Page Generation
hbs is an Express view engine that wraps Handlebars. Its registerAsyncHelper API bypasses Handlebars' automatic HTML escaping: an async helper returns an opaque placeholder during the first render pass, so the double-brace expression escapes only the placeholder, and after rendering hbs substitut...
Security Bulletin: IBM Spectrum Control is vulnerable to weaknesses related to Handlebars (CVE-2026-33937, CVE-2026-33938, CVE-2026-33939, CVE-2026-33940, CVE-2026-33941)
Summary Handlebars is vulnerable to Code Injection ,Improper Check for Unusual or Exceptional Conditions and Cross-site Scripting attacks. These vulnerabilities affect IBM Spectrum Control. Vulnerability Details CVEID:CVE-2026-33937 DESCRIPTION: Handlebars provides the power necessary to let user...
CLSA-2026-1787070403 TuxCare security update for handlebars (2 CVEs)
TuxCare rebuilt handlebars to address 2 CVEs. Fixed in 2.0.0-tuxcare.5...
PT-2026-83167
TuxCare rebuilt handlebars to address 2 CVEs. Fixed in 2.0.0-tuxcare.5...
CVE-2026-73617: Improper Neutralization of Special Elements in Data Query Logic
Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filtering. Attackers can inject MongoDB operators through query parameters to bypass...
EUVD-2026-53371
The render-template component of ember-dynamic-render-template addon/components/render-template.js passes its templateString property directly into Ember/Glimmer's compileTemplate from @ember/template-compilation with no sanitization, allow-listing, or validation of the input. Because...
CLSA-2026-1785117463 TuxCare security update for handlebars (5 CVEs)
TuxCare rebuilt handlebars to address 5 CVEs. Fixed in 3.0.8-tuxcare.3...
CLSA-2026-1784682992 TuxCare security update for handlebars (1 CVE)
TuxCare rebuilt handlebars to address 1 CVE. Fixed in 3.0.8-tuxcare.2...
CLSA-2026-1784596337 TuxCare security update for handlebars (3 CVEs)
TuxCare rebuilt handlebars to address 3 CVEs. Fixed in 3.0.8-tuxcare.1...
CLSA-2026-1782435546 TuxCare security update for handlebars (8 CVEs)
TuxCare rebuilt handlebars to address 8 CVEs. Fixed in 4.7.8-tuxcare.1...
CLSA-2026-1782349135 TuxCare security update for handlebars (8 CVEs)
TuxCare rebuilt handlebars to address 8 CVEs. Fixed in 4.7.7-tuxcare.1...
CLSA-2026-1776991069 TuxCare security update for handlebars (9 CVEs)
TuxCare rebuilt handlebars to address 9 CVEs. Fixed in 4.7.9-tuxcare.1...