CVE-2026-46634

CVE-2026-46634 affects Twig for PHP, where versions 3.9.0–3.26.0 allow template_from_string() to synthesize a name (string_template ) that can bypass a SourcePolicyInterface sandbox, enabling a sandboxed template to call template_from_string and include an inner template without security policy e...

CVE-2026-46634 Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name

Twig is a template language for PHP. From 3.9.0 until 3.26.0, templatefromstring compiles an inner template under a synthesized stringtemplate name that can fall outside a SourcePolicyInterface sandbox decision, allowing a sandboxed template that can call templatefromstring and include to render ...

GHSA-7RX3-5WX3-5V76

creationtimestamp| type| source ---|---|--- 2026-07-14 20:42:32+00:00| seen| https://gist.github.com/alon710/e9ace864fd0fc758277cc4aa4cece6b7 2026-07-14 20:43:17+00:00| seen| https://gist.github.com/alon710/69a35e6d85f7f0c43de5276d0ac08d9d...

CVE-2026-58617

creationtimestamp| type| source ---|---|--- 2026-07-14 20:42:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqn2yvy7q72t 2026-07-14 22:02:40+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:02:12+00:00| seen|...

CVE-2026-50158

creationtimestamp| type| source ---|---|--- 2026-07-14 20:35:02+00:00| published-proof-of-concept| https://github.com/eat-pray-ai/yutu/security/advisories/GHSA-2c7f-fxww-6w6c...

DEBIAN-CVE-2026-47737

Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when setremoteaddress proxyprotocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each keep-alive...

CVE-2026-47737

Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when setremoteaddress proxyprotocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each keep-alive...

UBUNTU-CVE-2026-47737

Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when setremoteaddress proxyprotocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each keep-alive...

GHSA-Q3V2-XJ35-9GRX

creationtimestamp| type| source ---|---|--- 2026-07-14 20:12:07+00:00| seen| https://gist.github.com/alon710/57f8fdc68fb17b420e33683532c115ad...

CVE-2026-5040

creationtimestamp| type| source ---|---|--- 2026-07-14 20:05:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqmyxth4og27...

CVE-2026-15701

creationtimestamp| type| source ---|---|--- 2026-07-14 20:04:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqmyuqumh72z...

CVE-2026-58101

creationtimestamp| type| source ---|---|--- 2026-07-14 20:01:57+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3mqmyqxupdh22...

CVE-2026-47301

creationtimestamp| type| source ---|---|--- 2026-07-14 20:01:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqmyqlcmbo2l 2026-07-16 12:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqr75ovixc2h 2026-07-16 13:51:39+00:00| seen|...

CVE-2026-47767

creationtimestamp| type| source ---|---|--- 2026-07-14 20:00:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqmyorqyxp2q 2026-07-16 15:38:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqrkwx3e5w2d 2026-07-17 22:37:06+00:00| seen|...

CVE-2026-47737 Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections

Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when setremoteaddress proxyprotocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each keep-alive...

CVE-2026-47737

Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when setremoteaddress proxyprotocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each keep-alive...

GHSA-G7MM-9VX7-JM7H

creationtimestamp| type| source ---|---|--- 2026-07-14 19:11:47+00:00| seen| https://gist.github.com/alon710/97fd87eaf3ecb37ec75f6abd3050d94a...

CVE-2026-50141

creationtimestamp| type| source ---|---|--- 2026-07-14 19:11:47+00:00| seen| https://gist.github.com/alon710/97fd87eaf3ecb37ec75f6abd3050d94a...

CVE-2026-50405

creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:30+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0231 2026-07-14 22:03:54+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:01:12+00:00| seen|...

CVE-2026-50448

creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:25+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0231 2026-07-14 22:04:23+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:01:05+00:00| seen|...