CVE-2026-103849: Improper Neutralization of Special Elements Used in a Template Engine

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation ...

PT-2026-111800

Name of the Vulnerable Software and Affected Versions Adobe Commerce versions 2.4.4 through 2.4.9 prior to October 2026 security releases Adobe Commerce B2B versions 1.3.x through 1.5.x Magento Open Source versions 2.4.6 through 2.4.9 prior to October 2026 security releases Description An imprope...

CVE-2026-108570

A security flaw has been discovered in Furion .NET Framework up to 4.9.9.95. This affects the function RunCompile of the file framework/Furion/ViewEngine/Engines/ViewEngine.cs of the component View Engine. The manipulation of the argument content results in improper neutralization of special...

PT-2026-110102

Name of the Vulnerable Software and Affected Versions Furion .NET Framework versions prior to 4.9.9.96 Description A flaw in the View Engine component allows remote attackers to manipulate the content argument within the RunCompile function of the framework/Furion/ViewEngine/Engines/ViewEngine.cs...

DEBIAN-CVE-2026-97030

A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped...

EUVD-2026-93772

LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, .first/.last, negative index, and for-loop iteration...

CVE-2026-67273

Dell Container Storage Modules, versions prior to 1.18.0, contains an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges...

EUVD-2026-93457

Dell Container Storage Modules, versions prior to 1.18.0, contains an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges...

CVE-2026-67273

Dell Container Storage Modules, versions prior to 1.18.0, contains an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges...

CVE-2026-67273

Dell Container Storage Modules (CSM) , versions prior to 1.18.0 , are vulnerable to an Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336). A low-privileged attacker with remote access can exploit this flaw to achieve Elevation of Privileges , access sensitive informa...

PT-2026-106765

Name of the Vulnerable Software and Affected Versions Dell Container Storage Modules versions prior to 1.18.0 Description An improper neutralization of special elements used in a template engine allows a low privileged attacker with remote access to potentially achieve elevation of privileges...

CVE-2026-67273: Improper Neutralization of Special Elements Used in a Template Engine

Dell Container Storage Modules, versions prior to 1.18.0, contains an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges...

CVE-2026-90970 Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape...

CVE-2026-103540 formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engine

A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/code/Clients.class.php of the component Client Settings. The manipulation of the argument pagetitles leads to improper...

CVE-2026-103540 formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engine

A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/code/Clients.class.php of the component Client Settings. The manipulation of the argument pagetitles leads to improper...

CVE-2026-103540 formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engine

A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/code/Clients.class.php of the component Client Settings. The manipulation of the argument pagetitles leads to improper...

EUVD-2026-90497

A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/code/Clients.class.php of the component Client Settings. The manipulation of the argument pagetitles leads to improper...

CVE-2026-103540: Improper Neutralization of Special Elements Used in a Template Engine

A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/code/Clients.class.php of the component Client Settings. The manipulation of the argument pagetitles leads to improper...

PT-2026-103675

A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/code/Clients.class.php of the component Client Settings. The manipulation of the argument page titles leads to improper...

CVE-2026-102142

A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stored template body. An authenticated System Administrator could potentially store a crafted template that executed operating-system commands on the appliance...