18555 matches found
CVE-2026-96824 WordPress Template Kit ā Import plugin <= 1.0.16 - Arbitrary File Deletion vulnerability
Editor Arbitrary File Deletion in Template Kit ā Import = 1.0.16 versions...
CVE-2026-96824
The WordPress Template Kit ā Import plugin, specifically versions
EUVD-2026-89877
Editor Arbitrary File Deletion in Template Kit ā Import = 1.0.16 versions...
Exploit for Code Injection in Craftcms Craft_Cms
CVE-2026-31857: Craft CMS control panel RCE CVE-2026-31857 is...
CVE-2026-103088
Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment fix for CVE-2026-63490 validates template locations as raw percent-encoded strings, whereas the template file is opened through a URL handler that percent-decodes the path. In a...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal via the view name parameter in a Spring MVC application when a file: template prefix is used. An attacker can access files outside the configured template base directory by submitting a percent-encoded traversal...
EUVD-2026-89555
Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment fix for CVE-2026-63490 validates template locations as raw percent-encoded strings, whereas the template file is opened through a URL handler that percent-decodes the path. In a...
CVE-2026-103088
Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment fix for CVE-2026-63490 validates template locations as raw percent-encoded strings, whereas the template file is opened through a URL handler that percent-decodes the path. In a...
CVE-2026-103088
Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment fix for CVE-2026-63490 validates template locations as raw percent-encoded strings, whereas the template file is opened through a URL handler that percent-decodes the path. In a...
CLEANSTART-2026-DP89465 Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used
Security vulnerability affects the minio-operator package. Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used...
EUVD-2026-89477
A security vulnerability has been detected in Naichen ThinkCMF up to 8.0.7. Affected by this issue is the function MailController::templatePut of the file cmf-api/src/admin/controller/MailController.php of the component Email Template. The manipulation leads to improper neutralization of special...
PT-2026-103321
šØ CVE-2026-100274 In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template š@cveNotify...
CVE-2026-100280: Missing Authorization
In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible...
CVE-2026-102142: Improper Neutralization of Special Elements Used in a Template Engine
A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stored template body. An authenticated System Administrator could potentially store a crafted template that executed operating-system commands on the appliance...
PT-2026-103327
šØ CVE-2026-100280 In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible š@cveNotify...
CVE-2026-103088: Path Traversal: '../filedir'
Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment fix for CVE-2026-63490 validates template locations as raw percent-encoded strings, whereas the template file is opened through a URL handler that percent-decodes the path. In a...
PT-2026-103575
Name of the Vulnerable Software and Affected Versions Kiteworks appliance affected versions not specified Description A system notification template on the Kiteworks appliance is processed by a template engine that evaluates expressions within the stored template body. This allows an authenticate...
PT-2026-103209
Editor Arbitrary File Deletion in Template Kit ā Import = 1.0.16 versions...
PT-2026-103319
šØ CVE-2026-100272 In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues š@cveNotify...
CVE-2026-100272: Authorization Bypass Through User-Controlled Key
In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues...