18852 matches found
CVE-2026-25718: Improper Link Resolution Before File Access
Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template processing to read or write through symlinked or otherwise non-regular paths...
PT-2026-55522
Name of the Vulnerable Software and Affected Versions RTMKit versions prior to 2.0.8 Description The RTMKit rometheme-for-elementor plugin for WordPress contains a Local File Inclusion flaw. This occurs because the render templates AJAX endpoint does not properly validate the template parameter...
CVE-2026-27783: Missing Authorization
Gitea versions up to and including 1.26.1 do not enforce repository-unit authorization on issue-template API endpoints...
EUVD-2026-33276
Mautic has Server-Side Template Injection SSTI in Theme Templates...
Mautic has Server-Side Template Injection (SSTI) in Theme Templates
Summary A Server-Side Template Injection SSTI vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute arbitrary code...
Horizon-Orchestration Cross-site scripting (XSS) vulnerability through resource name
Cross-site scripting XSS vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard Horizon before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject...
PYSEC-2026-642 Horizon-Orchestration Cross-site scripting (XSS) vulnerability through resource name
Cross-site scripting XSS vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard Horizon before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject...
OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability
Cross-site scripting XSS vulnerability in OpenStack Dashboard Horizon 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form...
PYSEC-2026-643 OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability
Cross-site scripting XSS vulnerability in OpenStack Dashboard Horizon 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form...
PYSEC-2026-756 Zope allows attackers to modify raw image and file data
Zope 2.2.0 through 2.2.4 does not properly protect a data updating method on Image and File objects, which allows attackers with DTML editing privileges to modify the raw data of these objects...
Zope DTML implementation Improper Authentication
The DTML implementation in the Z Object Publishing Environment Zope allows remote attackers to conduct unauthorized activities...
Zope does not properly restrict access to the getRoles method
Zope before 2.2.1 does not properly restrict access to the getRoles method, which allows users who can edit DTML to add or modify roles by modifying the roles list that is included in a request...
PYSEC-2026-757 Zope does not properly restrict access to the getRoles method
Zope before 2.2.1 does not properly restrict access to the getRoles method, which allows users who can edit DTML to add or modify roles by modifying the roles list that is included in a request...
MAL-2026-6725 Malicious code in @modhamanish/rn-mm-template (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bafa948cdfb9fda0d33e923e0e352a384adecfaaab1ece9a20b1b645c1b58ae6 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
CVE-2026-57687
Contributor SQL Injection in Custom Field Template = 2.7.8 versions...
CVE-2026-57687
Contributor SQL Injection in Custom Field Template = 2.7.8 versions...
CVE-2026-57687 WordPress Custom Field Template plugin <= 2.7.8 - SQL Injection vulnerability
Contributor SQL Injection in Custom Field Template = 2.7.8 versions...
EUVD-2026-41296
Contributor SQL Injection in Custom Field Template = 2.7.8 versions...
