18831 matches found
PT-2026-68098
Name of the Vulnerable Software and Affected Versions MacCMS10 affected versions not specified Description The admin template editor in application/admin/controller/Template.php uses a blacklist regex to block dangerous PHP functions in template content. However, the blacklist fails to include...
CVE-2026-71286: Improper Neutralization of Special Elements Used in a Template Engine
The render-template component of ember-dynamic-render-template addon/components/render-template.js passes its property directly into Ember/Glimmer's compileTemplate from @ember/template-compilation with no sanitization, allow-listing, or validation of the input...
CVE-2026-71291: Improper Neutralization of Special Elements Used in a Template Engine
Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/Entity/Field.php, getTwigValue calls shouldBeRenderedAsTwig, which gates rendering only on the field definition's allowtwig flag and a regex...
PT-2026-67945
Name of the Vulnerable Software and Affected Versions VikRentItems – Flexible Rental Management System versions prior to 1.2.2 Description Stored Cross-Site Scripting occurs via the customer email field of the booking checkout form. The issue stems from insufficient input sanitization and output...
CVE-2026-71232: Improper Control of Generation of Code
MacCMS10's admin template editor application/admin/controller/Template.php blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, showsource, createfunction, registershutdownfunction, registertickfunction, and errorlog...
CVE-2026-71215: Improper Limitation of a Pathname to a Restricted Directory
art-template's sub-template resolution logic src/compile/adapter/resolve-filename.js, used by both the include and extend template directives, resolves the target file path via path.resolveroot, filename with no check afterward that the result remains inside root...
PT-2026-68339
Name of the Vulnerable Software and Affected Versions Nuxt versions 3.4.0 through 3.21.9 Nuxt versions 4.0.0 through 4.5.0 Description An issue exists where an attacker can achieve server-side remote code execution in the Nitro process by injecting a template key through the / nuxt island/ endpoi...
PT-2026-68243
Name of the Vulnerable Software and Affected Versions Cisco Catalyst SD-WAN Manager affected versions not specified Description An issue in the web-based management interface allows an authenticated, remote attacker to view sensitive information in clear text. This occurs due to insufficient acce...
PT-2026-68159
Name of the Vulnerable Software and Affected Versions ember-dynamic-render-template affected versions not specified Description The render-template component in addon/components/render-template.js passes the templateString property directly into the compileTemplate function from...
PT-2026-68053
Name of the Vulnerable Software and Affected Versions art-template affected versions not specified Description Sub-template resolution logic in src/compile/adapter/resolve-filename.js, utilized by the include and extend template directives, fails to verify if the resolved file path remains within...
CVE-2026-69264
Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Node.js exposes eval and dynamic import,...
CVE-2026-69264
Flowise CSVAgent is affected. Prior to 3.1.3, an attacker-controlled segment of csvFile’s data URI is interpolated into a Python source-template executed by Pyodide; due to the default js bridge to globalThis in Node.js, this can be passed to js.eval and dynamically import Node built-ins (e.g., f...
Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API
Summary The POST /api/v1/prediction/:id endpoint — which is unauthenticated whitelisted in WHITELISTURLS — accepts an overrideConfig object in the request body. This object is unconditionally spread into the internal flowConfig and flowData objects at two locations in the codebase without checkin...
CVE-2026-69258
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the unauthenticated POST /api/v1/prediction/:id endpoint accepted an overrideConfig object and unconditionally spread it into internal flowConfig and flowData objects in...
CVE-2026-69258 Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the unauthenticated POST /api/v1/prediction/:id endpoint accepted an overrideConfig object and unconditionally spread it into internal flowConfig and flowData objects in...
CVE-2026-69258 Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the unauthenticated POST /api/v1/prediction/:id endpoint accepted an overrideConfig object and unconditionally spread it into internal flowConfig and flowData objects in...
MAL-2026-11597 Malicious code in @onereach/content-builder-template-compiler (npm)
npm/@onereach/content-builder-template-compiler is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were...
CVE-2026-69100
The CVE entry covers LAMP Rapid Development Platform up to version 5.6.2, where a flaw in GlueFactory allows unsandboxed Groovy scripts stored in database template fields to run without compilation restrictions or whitelisting. An attacker can modify or influence the script field via message temp...
CVE-2026-69100 LAMP 5.6.2 GlueFactory Unsandboxed Groovy Script Remote Code Execution
LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains a remote code execution vulnerability in GlueFactory that executes unsandboxed Groovy scripts from database template fields without compilation restrictions or whitelisting. Attackers can write or influence the scrip...