CVE-2026-40478 Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf

Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly...

CVE-2026-40478 Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf

Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly...

CVE-2026-40477

Thymeleaf (Java template engine) versions up to 3.1.3.RELEASE are affected by an SSTI vulnerability in expression execution, where unvalidated user input can bypass protections and access potentially sensitive objects within a template. This is a security bypass allowing unauthenticated remote ex...

Exploit for Code Injection in Xwiki

CVE-2025-24893 — XWiki SSTI Remote Code Execution Overview...

PT-2026-33214

Name of the Vulnerable Software and Affected Versions Thymeleaf versions prior to 3.1.4.RELEASE Description A security bypass exists in the expression execution mechanisms. The library fails to properly restrict the scope of accessible objects, which allows specific sensitive objects to be reache...

OPENSUSE-SU-2026:20579-1 Security update for gosec

This update for gosec fixes the following issues: Changes in gosec: - Update to version 2.25.0: choredeps: bump google.golang.org/grpc from 1.75.0 to 1.79.3 1617 fix: allow barry action to access secrets on fork PRs 1616 fix: reduce G117 false positives for custom marshalers and transformed value...

CVE-2026-34724

Zammad (web-based helpdesk) contains a server-side template injection vulnerability leading to remote code execution via the AI Agent, present before version 7.0.1. The impact is restricted to environments where an attacker can influence type_enrichment_data (typically high-privilege administrati...

CVE-2026-28797

RAGFlow is an open-source RAG Retrieval-Augmented Generation engine. In versions 0.24.0 and prior, a Server-Side Template Injection SSTI vulnerability exists in RAGFlow's Agent workflow Text Processing StringTransform and Message components. These components use Python's jinja2.Template unsandbox...

CVE-2026-26026 GLPI has a Server-Side Template Injection via Double-Compilation

GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, template injection by an administrator lead to RCE. This vulnerability is fixed in 11.0.6...

CVE-2026-26026 GLPI has a Server-Side Template Injection via Double-Compilation

GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, template injection by an administrator lead to RCE. This vulnerability is fixed in 11.0.6...

PyBlade: SSTI/RCE via Bypassed AST Validation in sandbox.py

A vulnerability has been found in AntaresMugisho PyBlade 0.1.8-alpha/0.1.9-alpha. The affected element is the function issafeast of the file sandbox.py of the component AST Validation. Such manipulation leads to improper neutralization of special elements used in a template engine. The attack may...

CVE-2026-28797 RAGFlow: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in Agent "Text Processing" Component

RAGFlow is an open-source RAG Retrieval-Augmented Generation engine. In versions 0.24.0 and prior, a Server-Side Template Injection SSTI vulnerability exists in RAGFlow's Agent workflow Text Processing StringTransform and Message components. These components use Python's jinja2.Template unsandbox...

CVE-2026-28797

RAGFlow is an open-source RAG Retrieval-Augmented Generation engine. In versions 0.24.0 and prior, a Server-Side Template Injection SSTI vulnerability exists in RAGFlow's Agent workflow Text Processing StringTransform and Message components. These components use Python's jinja2.Template unsandbox...

CVE-2026-4257

The Contact Form by Supsystic plugin for WordPress is vulnerable to Server-Side Template Injection SSTI leading to Remote Code Execution RCE in all versions up to, and including, 1.7.36. This is due to the plugin using the Twig TwigLoaderString template engine without sandboxing, combined with th...

CVE-2026-34172

Giskard agents contain a server-side template injection vulnerability in ChatWorkflow.chat(message): when a string is passed, it is treated as a Jinja2 template by a non-sandboxed Environment, enabling full RCE via class traversal. Affected versions are before 0.3.4 and 1.0.2b1; the issue is miti...

CVE-2026-4257

CVE-2026-4257 (Contact Form by Supsystic for WordPress) is an SSTI vulnerability that enables unauthenticated remote code execution in all versions up to 1.7.36. The root cause is the plugin’s use of the Twig Twig_Loader_String engine without sandboxing, combined with the cfsPreFill prefill featu...

CVE-2026-28228

OpenOLAT SAS/Velocity SSTI vulnerability (CVE-2026-28228) allows an authenticated author to inject Velocity directives into a reminder email; when processed, directives are evaluated server-side via Velocity #set chained with Java reflection, enabling arbitrary Java class execution (e.g., Process...

CVE-2026-28228 OpenOLAT: Server-Side Template Injection (SSTI) in Velocity templates allows Remote Code Execution

OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. Prior to versions 19.1.31, 20.1.18, and 20.2.5, an authenticated user with the Author role can inject Velocity directives into a reminder email template. When the reminder is processed...

tudo-exploits-oswe-prep

tudo-exploits-oswe-prep A project contains all exploits of vul...

PT-2026-29130

Name of the Vulnerable Software and Affected Versions Contact Form by Supsystic plugin for WordPress versions up to and including 1.7.36 Description The Contact Form by Supsystic plugin for WordPress is susceptible to Server-Side Template Injection SSTI, which can lead to Remote Code Execution RC...