CVE-2026-54216

CVE-2026-54216 affects Tobit Laboratories AG TeamDavid’s Webbox. The vulnerability is a reflected cross-site scripting (XSS) flaw in the application triggered by crafting a link with an arbitrary path and an XSS payload via the EntryInfo parameter, using the templateName=!templateName=entryMail, ...

CVE-2026-15359

The Templately WordPress plugin before 3.7.1 does not have an authorisation check on one of its request handlers, allowing unauthenticated attackers to overwrite the administrator's stored cloud service connection with an account under their control, disconnecting the legitimate administrator and...

CVE-2026-17505

creationtimestamp| type| source ---|---|--- 2026-08-07 06:03:16+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-17505.yaml 2026-08-08 00:02:14+00:00| confirmed|...

EUVD-2026-54382

The Templately WordPress plugin before 3.7.1 does not have an authorisation check on one of its request handlers, allowing unauthenticated attackers to overwrite the administrator's stored cloud service connection with an account under their control, disconnecting the legitimate administrator and...

CVE-2026-15359 Templately < 3.7.1 - Unauthenticated Administrator Templately Cloud Connection Overwrite

The Templately WordPress plugin before 3.7.1 does not have an authorisation check on one of its request handlers, allowing unauthenticated attackers to overwrite the administrator's stored cloud service connection with an account under their control, disconnecting the legitimate administrator and...

EUVD-2026-54298

The DataPress Dataverse Integration WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes the viewing user's data to it, allowing users with a role as low as Contributor to disclose sensitive information, such as the session cookies of higher...

EUVD-2026-54248

A Server-Side Template Injection SSTI vulnerability in WGDashboard version 4.3.2 and earlier, allows authenticated attackers to execute arbitrary code as root...

CVE-2026-5336

The DataPress Dataverse Integration WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes the viewing user's data to it, allowing users with a role as low as Contributor to disclose sensitive information, such as the session cookies of higher...

CVE-2026-15734

A Server-Side Template Injection SSTI vulnerability in WGDashboard version 4.3.2 and earlier, allows authenticated attackers to execute arbitrary code as root...

CVE-2026-71430 node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function built its replacement result and passed it to V8 using ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the resulting string or buffer exceeds V8's...

CVE-2026-71430

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function built its replacement result and passed it to V8 using ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the resulting string or buffer exceeds V8's...

Protection Mechanism Failure

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Protection Mechanism Failure through the SecurityPolicy process. An attacker can execute arbitrary code on the server by rendering a malicious Twig template after authenticating to the contro...

CVE-2026-71502

CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled data. An unauthenticated attacker can create a public conversion whose name or description contains a malicious Vue...

CVE-2026-71502 Unauthenticated Stored Vue Template Injection Leads to Cross-Site Scripting in CTI-Transmute

CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled data. An unauthenticated attacker can create a public conversion whose name or description contains a malicious Vue...

CVE-2026-71502 Unauthenticated Stored Vue Template Injection Leads to Cross-Site Scripting in CTI-Transmute

CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled data. An unauthenticated attacker can create a public conversion whose name or description contains a malicious Vue...

CVE-2026-71502 Unauthenticated Stored Vue Template Injection Leads to Cross-Site Scripting in CTI-Transmute

CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled data. An unauthenticated attacker can create a public conversion whose name or description contains a malicious Vue...

CVE-2026-71502

CTI-Transmute is impacted by an unauthenticated stored XSS via Vue template expression injection. The vulnerability arises from insufficient neutralization of Vue {{…}} / [[…]] delimiters in server-rendered user-controlled data (e.g., public conversion names/descriptions; possible user profile na...

CVE-2026-15734

A Server-Side Template Injection (SSTI) vulnerability exists in WGDashboard version 4.3.2 and earlier . This flaw, categorized as an improper neutralization of special elements used in a template engine, allows authenticated attackers to execute arbitrary code as root . Exploitation details and p...

CVE-2026-15734 WGDashboard Server-Side Template Injection vulnerability

A Server-Side Template Injection SSTI vulnerability in WGDashboard version 4.3.2 and earlier, allows authenticated attackers to execute arbitrary code as root...

CVE-2026-15734 WGDashboard Server-Side Template Injection vulnerability

A Server-Side Template Injection SSTI vulnerability in WGDashboard version 4.3.2 and earlier, allows authenticated attackers to execute arbitrary code as root...