CVE-2026-72256

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtcluster: reject template conntracks in hash match xtclustermt treats any non-NULL nfctget result as a fully initialized conntrack and passes it to xtclusterhash. This causes a state confusion bug when the raw table C...

CVE-2026-72256 netfilter: xt_cluster: reject template conntracks in hash match

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtcluster: reject template conntracks in hash match xtclustermt treats any non-NULL nfctget result as a fully initialized conntrack and passes it to xtclusterhash. This causes a state confusion bug when the raw table C...

EUVD-2026-59155

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtcluster: reject template conntracks in hash match xtclustermt treats any non-NULL nfctget result as a fully initialized conntrack and passes it to xtclusterhash. This causes a state confusion bug when the raw table C...

CVE-2026-72256 netfilter: xt_cluster: reject template conntracks in hash match

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtcluster: reject template conntracks in hash match xtclustermt treats any non-NULL nfctget result as a fully initialized conntrack and passes it to xtclusterhash. This causes a state confusion bug when the raw table C...

CVE-2026-72256

CVE-2026-72256 (Linux kernel netfilter xt_cluster) : The issue arises in xt_cluster_mt() which treats any non-NULL nf_ct_get() result as a fully initialized conntrack and passes it to xt_cluster_hash(). When a template conntrack is attached to skb->_nfct before normal processing, it carries IP...

Helm: Helm: Denial of Service via malformed chart files

A flaw was found in Helm. A remote attacker can exploit a denial of service vulnerability by including zero-length byte slices, such as empty files, within Helm chart files. This can trigger an index out of range panic in the Files.Lines template helper, leading to deterministic render failures...

SUSE CVE-2026-13051

Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic that validate passes to adderror as a Locale::Maketext template. validate runs HTML::Tidy over the submitted markup and passes...

PT-2026-73054

siyuan versions = 3.7.3 fixed in v3.7.4 contain a server-side template injection vulnerability in the attribute-view Template calculation feature introduced in v3.7.0-beta.1. The feature's template engine uses Sprig's unmodified function map, which still exposes the env, expandenv, and...

CVE-2026-73047: Exposure of Sensitive Information to an Unauthorized Actor

siyuan versions = 3.7.3 fixed in v3.7.4 contain a server-side template injection vulnerability in the attribute-view Template calculation feature introduced in v3.7.0-beta.1. The feature's template engine uses Sprig's unmodified function map, which still exposes the env, expandenv, and...

PT-2026-72444

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A state confusion bug exists in the netfilter module. The function xt cluster mt incorrectly treats any non-NULL result from nf ct get as a fully initialized conntrack and passes it to x...

PT-2026-73050

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description A remote code execution issue exists in the Template calculation operator. The software renders user-authored Go templates and stores the output without sanitization. This allows attackers to inject...

CVE-2026-18438: Unrestricted Upload of File with Dangerous Type

The Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.7.1 via the fetchremotefile function. This is due to a filename validation/destination mismatch ...

CVE-2026-73043: Improper Neutralization of Input During Web Page Generation

SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and stores output verbatim without sanitization. Attackers can inject malicious HTML and JavaScript into template calculations that execute in...

SUSE CVE-2026-16033

A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory specifically affecti...

CVE-2026-10768

creationtimestamp| type| source ---|---|--- 2026-08-14 18:00:14+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-10768.yaml 2026-08-15 00:00:14+00:00| confirmed|...

CVE-2026-46439

compliance-trestle is a tooling platform for managing compliance as code. Versions prior to 3.12.2 and 4.0.3 have a Server-Side Template Injection SSTI vulnerability exists in the trestle author jinja command. The command recursively evaluates rendered templates, allowing an attacker to achieve...

CVE-2026-73505

A flaw was found in Oh My Posh. A local attacker could craft a malicious directory name containing a Go template expression. When the prompt renders within this directory or its subdirectories, the embedded template expression could execute arbitrary operating system commands as the current user...

CVE-2026-46439 compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)

compliance-trestle is a tooling platform for managing compliance as code. Versions prior to 3.12.2 and 4.0.3 have a Server-Side Template Injection SSTI vulnerability exists in the trestle author jinja command. The command recursively evaluates rendered templates, allowing an attacker to achieve...

EUVD-2026-58711

compliance-trestle is a tooling platform for managing compliance as code. Versions prior to 3.12.2 and 4.0.3 have a Server-Side Template Injection SSTI vulnerability exists in the trestle author jinja command. The command recursively evaluates rendered templates, allowing an attacker to achieve...

CVE-2026-46439

CVE-2026-46439 (compliance-trestle SSTI): A Server-Side Template Injection exists in the TreSTLE tool when running the command trestle author jinja. The vulnerability arises from recursive re-rendering of data-bound templates, allowing an attacker-controlled payload embedded in SSPs or Lookup Tab...