PT-2026-23922

A vulnerability has been found in OpenCart 4.0.2.3. Affected by this issue is the function Save of the file admin/controller/design/template.php of the component Incomplete Fix CVE-2024-36694. Such manipulation leads to improper neutralization of special elements used in a template engine. The...

OpenCart 安全漏洞

OpenCart is an open-source e-commerce system developed by the OpenCart team in China. This system provides modules for product reviews, product ratings, and product addition. Version 4.0.2.3 of OpenCart contains a security vulnerability, which stems from improper handling of special elements in t...

CVE-2026-30928

creationtimestamp| type| source ---|---|--- 2026-03-07 15:25:03+00:00| published-proof-of-concept| https://github.com/nicolargo/glances/security/advisories/GHSA-gh4x-f7cq-wwx6 2026-03-19 06:17:14+00:00| confirmed|...

CVE-2026-29184

Backstage is an open framework for building developer portals. Prior to version 3.1.4, a malicious scaffolder template can bypass the log redaction mechanism to exfiltrate secrets provided run through task event logs. This issue has been patched in version 3.1.4...

CVE-2026-29184

Backstage is an open framework for building developer portals. Prior to version 3.1.4, a malicious scaffolder template can bypass the log redaction mechanism to exfiltrate secrets provided run through task event logs. This issue has been patched in version 3.1.4...

CVE-2026-29184 @backstage/plugin-scaffolder-backend: Potential Session Token Exfiltration via Log Redaction Bypass

Backstage is an open framework for building developer portals. Prior to version 3.1.4, a malicious scaffolder template can bypass the log redaction mechanism to exfiltrate secrets provided run through task event logs. This issue has been patched in version 3.1.4...

CVE-2026-28507

Idno is a social publishing platform. Prior to version 1.6.4, there is a remote code execution vulnerability via chained import file write and template path traversal. This issue has been patched in version 1.6.4...

Server-Side Template Injection

Craft CMS is vulnerable to Server-Side Template Injection. The vulnerability is due to improper handling of Twig input using the map filter in certain fields, which allows an attacker to craft malicious payloads and execute arbitrary code on the server...

Server-Side Template Injection

craftcms/cms is vulnerable to Server-Side Template Injection. The vulnerability is due to improper handling of Twig input using the map filter in certain fields, which allows an attacker with sufficient access to craft malicious payloads and execute arbitrary code on the server...

Remote Code Execution (RCE)

Craft CMS is vulnerable to Remote Code Execution RCE. The vulnerability is due to a Server-Side Template Injection SSTI flaw in Twig template fields, which allows an authenticated administrator to write a malicious PHP file to a web-accessible directory and execute arbitrary system commands...

Server-Side Template Injection

craftcms/cms is vulnerable to Template Injection. The vulnerability is due to unsafe exposure of the create Twig function allowing arbitrary object instantiation combined with a Symfony Process gadget chain, which allows an attacker to execute arbitrary system commands on the server...

Server-Side Template Injection

Craft CMS is vulnerable to Server-Side Template Injection. The vulnerability is due to unsafe exposure of the create Twig function enabling arbitrary object instantiation combined with a Symfony Process gadget chain, which allows an attacker to execute arbitrary code on the server...

Command Injection

idno/known is vulnerable to Command Injection. The vulnerability is due to improper handling of file imports combined with template path traversal, which allows an attacker to write malicious files and execute arbitrary code on the server...

WordPress Stock Ticker plugin <= 3.26.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Template vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting via Template vulnerability discovered by WordFence in WordPress Plugin Stock Ticker versions = 3.26.1...

CVE-2026-27142 URLs in meta content attribute actions are not escaped in html/template

Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actio...

Cross-site Scripting (XSS)

Overview std/html/template is a Go standard library package std/html/template Affected versions of this package are vulnerable to Cross-site Scripting XSS. Go Vulnerability Report:Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the met...

CVE-2026-26195

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, stored xss is still possible through unsafe template rendering that mixes user input with safe plus permissive sanitizer handling of data urls. This issue has been patched in version 0.14.2...

Django: Django: Denial of Service via crafted HTML inputs

A flaw was found in Django. A remote attacker can exploit this vulnerability by providing crafted inputs containing a large number of unmatched HTML end tags to the django.utils.text.Truncator.chars and Truncator.words methods when html=True, or through the truncatecharshtml and truncatewordshtml...

EUVD-2026-10026

An authenticated Zabbix user User role with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthorized hosts. Note that the User role is normally not sufficient to create and edit templates/hosts even...

CVE-2026-23925

A flaw was found in Zabbix. An authenticated user with the 'User' role, who also possesses write permissions for templates or hosts, can exploit the configuration.import API. This allows them to create unauthorized objects, such as hosts, which can lead to a loss of confidentiality within the...