PT-2026-45524

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions 31.0.0 through 31.0.13 Nextcloud Server versions 32.0.0 through 32.0.3 Nextcloud Enterprise Server versions prior to 28.0.14.15 Nextcloud Enterprise Server versions prior to 29.0.17.12 Nextcloud Enterprise Server...

PT-2026-45372

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.2.2 Description A bug in the rendered-template field handling allows the bypass of nested sensitive-key masking. When a rendered field exceeds the core max templated field length limit, the software stringifi...

The vulnerability of the JavaScript-based Thymeleaf framework lies in the lack of measures taken to neutralize special elements used in the expression language. This allows attackers to execute Server Side Template Injection (SSTI) attacks.

The vulnerability of the JavaScript-based Thymeleaf framework is related to the lack of measures taken to neutralize special elements used in the expression language operator. Exploiting this vulnerability can allow a remote attacker to execute a Server Side Template Injection SSTI attack...

Security Vulnerabilities fixed in Firefox for iOS 151.2 — Mozilla

Firefox for iOS Reader View replaced page content in its HTML template before replacing other internal placeholders. A malicious page could include a placeholder string that was later substituted with JSON-LD data, potentially resulting in arbitrary JavaScript execution. Firefox for iOS Reader Vi...

Updated perl-Template-Toolkit packages fix security vulnerability

Template::Plugin::HTML versions through 3.102 for Perl allows HTML and JavaScript to be injected. CVE-2026-5090...

MGASA-2026-0166 Updated perl-Template-Toolkit packages fix security vulnerability

Template::Plugin::HTML versions through 3.102 for Perl allows HTML and JavaScript to be injected. CVE-2026-5090...

CVE-2026-49382

In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright plugin...

CVE-2026-45697 Formie: Pre-authenticated server-side template injection in Hidden fields

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.20 and 3.1.24, unauthenticated users could submit crafted values into Hidden fields with Default value → Custom that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site depending ...

CVE-2026-45697 Formie: Pre-authenticated server-side template injection in Hidden fields

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.20 and 3.1.24, unauthenticated users could submit crafted values into Hidden fields with Default value → Custom that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site depending ...

CVE-2026-45697

Formie (Craft CMS plugin) exposes a pre-authenticated server-side template injection via Hidden fields configured with Default value → Custom. Unauthenticated users could submit crafted values that are evaluated as Twig during submission handling, potentially compromising the Craft site. Affected...

CAPM3 vulnerable to Cross-Namespace resource access

Summary CAPM3 is Metal3's Cluster API CAPI provider for baremetal provisioning in Kubernetes. Multiple cross-namespace access control vulnerabilities in Cluster API Provider Metal3 allow users with permissions to create or modify CAPM3 resources in one namespace to reference, read, or claim...

GHSA-RF84-WR5G-M3RP CAPM3 vulnerable to Cross-Namespace resource access

Summary CAPM3 is Metal3's Cluster API CAPI provider for baremetal provisioning in Kubernetes. Multiple cross-namespace access control vulnerabilities in Cluster API Provider Metal3 allow users with permissions to create or modify CAPM3 resources in one namespace to reference, read, or claim...

Exploit for CVE-2026-46376

CVE-2026-46376 — FreePBX Unauthenticated UCP Access via Hard-C...

CVE-2026-49382

In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright plugin...

CVE-2026-49382

In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright plugin...

EUVD-2026-33390

In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright plugin...

CVE-2026-49382

In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright plugin...

CVE-2026-49382

CVE-2026-49382 affects JetBrains IntelliJ IDEA prior to 2026.1. The issue allows code execution via template injection in the Copyright plugin. This is the concrete vulnerability described across trusted sources; no exploit details are provided in the connected documents. The core root cause is t...

CVE-2026-49382

In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright plugin...

CVE-2026-39276

The template upload feature in Emlog Pro v2.6.9 has a path traversal vulnerability, allowing authenticated administrators to execute arbitrary PHP code. By uploading a malicious ZIP archive containing directory traversal sequences in filenames, an attacker can overwrite default template files or...