CVE-2026-48806

Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allowing PHP to invoke toString on a Stringable object used as a mapping key without calling SandboxExtension::ensureToStringAllowed. This issue is fixed in versi...

CVE-2026-48806

Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allowing PHP to invoke toString on a Stringable object used as a mapping key without calling SandboxExtension::ensureToStringAllowed. This issue is fixed in versi...

CVE-2026-48806 Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys

Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allowing PHP to invoke toString on a Stringable object used as a mapping key without calling SandboxExtension::ensureToStringAllowed. This issue is fixed in versi...

CVE-2026-48806

Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allowing PHP to invoke toString on a Stringable object used as a mapping key without calling SandboxExtension::ensureToStringAllowed. This issue is fixed in versi...

CVE-2026-48806

Twig (PHP) prior to 3.27.0 is vulnerable to a Sandbox __toString() policy bypass via dynamic mapping keys in ArrayExpression. The issue allows a Stringable object used as a mapping key to invoke its __toString() without SandboxExtension::ensureToStringAllowed(), enabling potential data exposure a...

EUVD-2026-44513

Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allowing PHP to invoke toString on a Stringable object used as a mapping key without calling SandboxExtension::ensureToStringAllowed. This issue is fixed in versi...

CVE-2026-48806 Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys

Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allowing PHP to invoke toString on a Stringable object used as a mapping key without calling SandboxExtension::ensureToStringAllowed. This issue is fixed in versi...

CVE-2026-48806

Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allowing PHP to invoke toString on a Stringable object used as a mapping key without calling SandboxExtension::ensureToStringAllowed. This issue is fixed in versi...

CVE-2026-48806 Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys

Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allowing PHP to invoke toString on a Stringable object used as a mapping key without calling SandboxExtension::ensureToStringAllowed. This issue is fixed in versi...

How Qualys ETM Identity Detects Identity-Based Attacks Faster

Key Takeaways Identity-based attacks are among the fastest and most effective intrusion methods because valid credentials let attackers operate as trusted users. Techniques like Pass-the-Hash, Kerberoasting, Domain Controller Synchronization DCSync, and Authentication Server Response Roasting...

UBUNTU-CVE-2026-54058

Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.tobytes, getpixel,...

Designing a GDPR-Compliant Security Architecture for Remote Elderly Care Systems: A Privacy-By-Design Approach

IoMT-based remote elderly care systems generate continuous streams of sensitive health data, yet existing security architectures have not simultaneously addressed three interdependent challenges: GDPR-compliant edge-layer pseudonymisation, elderly-specific zero-interaction usability as a binding...

exploitdb-json

ExploitDB-JSON Generates a JSON file indexing exploits from...

FoundationAgents MetaGPT: Deserialization through flawed argument mapping via Message.check_instruct_content()

A weakness has been identified in FoundationAgents MetaGPT up to 0.8.2. This affects the function Message.checkinstructcontent of the file metagpt/schema.py. Executing a manipulation of the argument mapping can lead to deserialization. The attack is restricted to local execution. The exploit has...

PYSEC-2026-2637 FoundationAgents MetaGPT: Deserialization through flawed argument mapping via Message.check_instruct_content()

A weakness has been identified in FoundationAgents MetaGPT up to 0.8.2. This affects the function Message.checkinstructcontent of the file metagpt/schema.py. Executing a manipulation of the argument mapping can lead to deserialization. The attack is restricted to local execution. The exploit has...

synth-mapping-helper (>=1.5.1, <=1.5.2) potentially affected by CVE-2026-45554 via nicegui (2.3.0)

nicegui PYPI version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper =1.5.1, =1.5.2 Source cves: CVE-2026-45554 Source advisory: OSV:PYSEC-2026-2680...

synth-mapping-helper (>=1.5.3, <=1.5.7) potentially affected by CVE-2026-45554 via nicegui (2.5.0)

nicegui PYPI version 2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper =1.5.3, =1.5.7 Source cves: CVE-2026-45554 Source advisory: OSV:PYSEC-2026-2680...

synth-mapping-helper (1.4.7) potentially affected by CVE-2026-45554 via nicegui (1.4.30)

nicegui PYPI version 1.4.30 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper 1.4.7 Source cves: CVE-2026-45554 Source advisory: OSV:PYSEC-2026-2680...

synth-mapping-helper (1.5.8) potentially affected by CVE-2026-45554 via nicegui (2.7.0)

nicegui PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper 1.5.8 Source cves: CVE-2026-45554 Source advisory: OSV:PYSEC-2026-2680...

synth-mapping-helper (>=1.5.13, <=1.5.14) potentially affected by CVE-2026-45554 via nicegui (2.18.0)

nicegui PYPI version 2.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper =1.5.13, =1.5.14 Source cves: CVE-2026-45554 Source advisory: OSV:PYSEC-2026-2680...