EUVD-2026-67007

Affected versions of Flowintel allow the LOGFILE configuration value to be modified through system settings without restricting it to a filename inside the intended log directory. Because the application constructs the log destination from this configurable value, an administrator could set LOGFI...

CVE-2026-81743

Flowintel versions >=3.3.0 allow the LOG_FILE configuration value to be modified through system settings without restricting it to a filename inside the intended log directory. Because the application constructs the log destination from this value, an attacker with high privileges can set LOG_...

CVE-2026-81743 Flowintel Arbitrary Log File Path Allows Remote Code Execution via Template Injection

Affected versions of Flowintel allow the LOGFILE configuration value to be modified through system settings without restricting it to a filename inside the intended log directory. Because the application constructs the log destination from this configurable value, an administrator could set LOGFI...

CVE-2026-81743 Flowintel Arbitrary Log File Path Allows Remote Code Execution via Template Injection

Affected versions of Flowintel allow the LOGFILE configuration value to be modified through system settings without restricting it to a filename inside the intended log directory. Because the application constructs the log destination from this configurable value, an administrator could set LOGFI...

CVE-2026-46439

A flaw was found in compliance-trestle. This Server-Side Template Injection SSTI vulnerability exists in the trestle author jinja command, which recursively evaluates rendered templates. An attacker can inject malicious payloads into data fields, such as SSP documents or Lookup Tables, to achieve...

CVE-2026-81658

Foreman is affected by an authorization flaw in its template revision endpoint , which does not enforce object-level authorization when retrieving audited template revisions. An authenticated, low-privileged user with a template-related permission (e.g., view_ptables) can retrieve historical temp...

CVE-2026-81658 Foreman: cross-tenant disclosure of template revisions via unauthorized audit lookup

A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as viewptables, can obtain historical template contents belonging to...

CVE-2026-81658

A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as viewptables, can obtain historical template contents belonging to...

CVE-2026-81658 Foreman: cross-tenant disclosure of template revisions via unauthorized audit lookup

A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as viewptables, can obtain historical template contents belonging to...

EUVD-2026-66996

A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as viewptables, can obtain historical template contents belonging to...

CVE-2026-81658

A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as viewptables, can obtain historical template contents belonging to...

tryhackme-ctf-writeups

TryHackMe Write-Ups Thirteen rooms, solved and then explain...

PT-2026-82500

Name of the Vulnerable Software and Affected Versions Flowintel versions 3.3.0 and later Description Flowintel allows the LOG FILE configuration value to be modified via system settings without restricting it to the intended log directory. This allows an administrator to set LOG FILE to an...

CVE-2026-37004

BerriAI litellm =1.82.4 is vulnerable to Server-Side Template Injection SSTI, which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotpromptcontent parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment...

PT-2026-82662

Name of the Vulnerable Software and Affected Versions litellm versions prior to 1.82.5 Description An issue exists where unauthenticated remote attackers can execute arbitrary OS commands. This occurs due to the use of an unsandboxed jinja2.Environment, which enables Server-Side Template Injectio...

PT-2026-82686

Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an attacker with permission to author the advanced workflow email template can place a specially crafted server-side template payload in NotifyUsersWorkflowAction.EmailTemplate...

CVE-2026-19092: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output...

AlmaLinux 8 : go-toolset:rhel8 (ALSA-2026:60305)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:60305 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial of...

AlmaLinux 9 : golang (ALSA-2026:60304)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:60304 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial of...

CVE-2026-54718: Improper Neutralization of Special Elements Used in a Template Engine

Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an attacker with permission to author the advanced workflow email template can place a specially crafted server-side template payload in NotifyUsersWorkflowAction.EmailTemplate...