LiquidJS is Vulnerable to Remote Code Execution

Summary It is possible to execute arbitrary code with crafted templates Details 1|valueOf - this when evaluating the filter liquid %assign r=1|valueOf% r|inspect json...

@agiflowai/aicode-toolkit (>=0.6.0, <=1.1.0), @agiflowai/one-mcp (0.4.0) +103 more potentially affected by CVE-2026-45617 via liquidjs (>=10.15.0, <=10.25.7)

liquidjs NPM version =10.15.0, =0.6.0, =0.1.0, =0.0.0, =0.5.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.2, =0.0.1-alpha.0, =0.0.1-alpha.2, =0.0.1-alpha.0, =0.8.0, =1.0.1-beta.0, =1.6.3, =1.6.6 and more Source cves: CVE-2026-45617 Source advisory: SNYK:JS-LIQUIDJS-16960001...

Improper Validation of Specified Index, Position, or Offset in Input

Overview twig/twig is a flexible, fast, and secure template language for PHP. Affected versions of this package are vulnerable to Improper Validation of Specified Index, Position, or Offset in Input in the SandboxNodeVisitor that allows toString policy bypass via Traversable in join/replace filte...

Incorrect Authorization

Overview twig/twig is a flexible, fast, and secure template language for PHP. Affected versions of this package are vulnerable to Incorrect Authorization via the deprecated twigarraysome, twigarrayevery, and twigcheckarrowinsandbox helper functions. An attacker can bypass the sandbox callback...

Incorrect Authorization

Overview twig/twig is a flexible, fast, and secure template language for PHP. Affected versions of this package are vulnerable to Incorrect Authorization via dynamic mapping key handling in ArrayExpression. An attacker can bypass the sandbox toString restrictions by using a stringable object as a...

CVE-2026-38930

OpenRapid RapidCMS v1.3.1 was discovered to contain an authentication bypass in the /template/default/menu.php component. This vulnerability is exploited via injecting a crafted SQL payload into the name cookie parameter...

lodash: lodash: Arbitrary code execution via untrusted input in template imports

A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in .template but did not apply the same validation to options.imports key names. Both paths flow into the same Function constructor sink. Additionally, .template uses assignInWith to merge imports, whi...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses path-to-regexp-0.1.12.tgz, mlflow-3.9.0rc0-py3-none-any.whl, lodash-4.17.23.tgz, tomcat-embed-core-10.1.53.jar, spring-security-config-6.5.9.jar, Mako-1.3.8-py3-none-any.whl, uuid-11.1.0.tgz, spring-boot-3.5.13.jar, mako-1.3.11-py3-none-any.whl and...

Security Bulletin: IBM Quantum Safe Remediator is affected by mutiple vulnerabilities

Summary The vulnerabilities are found in the dependent open source libraries used in IBM Quantum Safe Remediator code base. IBM Quantum Safe Remediator has addressed these vulnerabilities by updating the versions of the affected libraries. Vulnerability Details CVEID:CVE-2026-2950 DESCRIPTION:...

org.jenkinsci.plugins:emailext-template (0.4) potentially affected by CVE-2026-48920 via org.jenkins-ci.plugins:email-ext (2.40.3)

org.jenkins-ci.plugins:email-ext MAVEN version 2.40.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:email-ext and may be impacted: - org.jenkinsci.plugins:emailext-template 0.4 Source cves: CVE-2026-48920 Source advisory:...

org.jenkinsci.plugins:emailext-template (>=0.1-beta, <=0.3) potentially affected by CVE-2026-48920 via org.jenkins-ci.plugins:email-ext (2.37.2.2)

org.jenkins-ci.plugins:email-ext MAVEN version 2.37.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:email-ext and may be impacted: - org.jenkinsci.plugins:emailext-template =0.1-beta, =0.3 Source cves: CVE-2026-48920 Source...

org.jenkinsci.plugins:emailext-template (249.v81d6ea_f33f2e) potentially affected by CVE-2026-48920 via org.jenkins-ci.plugins:email-ext (1916.vc954a_f86ff21)

org.jenkins-ci.plugins:email-ext MAVEN version 1916.vc954af86ff21 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:email-ext and may be impacted: - org.jenkinsci.plugins:emailext-template 249.v81d6eaf33f2e Source cves:...

org.jenkins-ci.plugins:email-ext-recipients-column (72.v546836954562), org.jenkinsci.plugins:emailext-template (233.v1eb_88fc160b_5) potentially affected by CVE-2026-48920 via org.jenkins-ci.plugins:email-ext (1876.v28d8d38315b_d)

org.jenkins-ci.plugins:email-ext MAVEN version 1876.v28d8d38315bd is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:email-ext and may be impacted: - org.jenkins-ci.plugins:email-ext-recipients-column 72.v546836954562 -...

org.jenkinsci.plugins:emailext-template (224.va_f6a_ecd5d46e) potentially affected by CVE-2026-48920 via org.jenkins-ci.plugins:email-ext (1866.v14fa_6d201654)

org.jenkins-ci.plugins:email-ext MAVEN version 1866.v14fa6d201654 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:email-ext and may be impacted: - org.jenkinsci.plugins:emailext-template 224.vaf6aecd5d46e Source cves:...

org.jenkinsci.plugins:emailext-template (219.v14fff547f78d) potentially affected by CVE-2026-48920 via org.jenkins-ci.plugins:email-ext (1844.v3ea_a_b_842374a)

org.jenkins-ci.plugins:email-ext MAVEN version 1844.v3eaab842374a is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:email-ext and may be impacted: - org.jenkinsci.plugins:emailext-template 219.v14fff547f78d Source cves:...

org.jenkinsci.plugins:emailext-template (>=1.0, <=1.1) potentially affected by CVE-2026-48920 via org.jenkins-ci.plugins:email-ext (2.43)

org.jenkins-ci.plugins:email-ext MAVEN version 2.43 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:email-ext and may be impacted: - org.jenkinsci.plugins:emailext-template =1.0, =1.1 Source cves: CVE-2026-48920 Source advisory:...

org.jenkins-ci.plugins:cisco-spark (>=1.1.0, <=1.1.1), org.jenkins-ci.plugins:email-ext-recipients-column (>=1.0, <=72.v546836954562) +2 more potentially affected by CVE-2026-48920 via org.jenkins-ci.plugins:email-ext (>=2.25, <=1916.vc954a_f86ff21)

org.jenkins-ci.plugins:email-ext MAVEN version =2.25, =1.1.0, =1.0, =1.1, =0.1-beta, =249.v81d6eaf33f2e Source cves: CVE-2026-48920 Source advisory: MEND:CVE-2026-48920...

Security update for go1.25-openssl

This update for go1.25-openssl fixes the following issues Security issues: CVE-2026-33811: net: crash when handling long CNAME response bsc1264508. CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1264506. CVE-2026-39817: cmd/go: "go tool pack" do...

SUSE-SU-2026:2093-1 Security update for go1.25-openssl

This update for go1.25-openssl fixes the following issues Security issues: - CVE-2026-33811: net: crash when handling long CNAME response bsc1264508. - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1264506. - CVE-2026-39817: cmd/go: 'go tool...

SUSE-SU-2026:2092-1 Security update for go1.26-openssl

This update for go1.26-openssl fixes the following issues Security issues: - CVE-2026-33811: net: crash when handling long CNAME response bsc1264508. - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1264506. - CVE-2026-39817: cmd/go: 'go tool...