cve-2026-87902-detection

wp-ghsa-7hp8-lab Herramientas de detección y banco de pruebas reproducible para GHSA-7hp8-65ch-5whp / CVE-2026-87902 — unauthenticated path traversal in page-template resolution leading to conditional RCE WordPress, CWE-98, CVSS 4.0: 9.2. | ---|--- check/| Controlador remoto, pasivo, sin acceso a...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

PT-2026-97681

This module enables you to use AI to fill in or replace text in CKEditor. The module doesn't sufficiently mitigate Twig template injections in certain AI CKEditor rules, making it possible to use Twig functions to extract certain confidential system data...

PT-2026-97411

Name of the Vulnerable Software and Affected Versions @orval/core versions prior to 8.28.0 Description A code injection issue exists in the form-data serializer. The component fails to escape multipart property names within generated template literals. This allows attackers to inject $...

PT-2026-97408

Name of the Vulnerable Software and Affected Versions orval versions 8.14.0 through 8.28.1 Description The @orval/effect generator improperly converts OpenAPI schema defaults into template literals. This allows for code injection where arbitrary JavaScript expressions using the $... syntax can be...

CVE-2026-96755: Improper Control of Generation of Code

orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing $... syntax, which are executed at module...

CVE-2026-96758: Improper Control of Generation of Code

orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject $... expressions into OpenAPI schema property names that execute as live interpolation when the...

CVE-2026-79310: Improper Control of Generation of Code

webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to an...

CVE-2026-73858: Improper Neutralization of Special Elements Used in a Template Engine

Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated attacker can place Twig expressions in...

CVE-2026-12370: Improper Neutralization of Special Elements Used in a Template Engine

ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vulnerable to a Server-Side Template Injection vulnerability in Configlet processing, which could lead to Remote Code Execution...

AI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-187

This module enables you to use AI to fill in or replace text in CKEditor. The module doesn't sufficiently mitigate Twig template injections in certain AI CKEditor rules, making it possible to use Twig functions to extract certain confidential system data...

CVE-2026-79310

webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to an...

WordPress 7.1.1 Local File Inclusion Scanner

WordPress versions 4.7.0 through 7.1.1 contain an unauthenticated page-template path traversal issue that can include readable local PHP files. This tool probes the wp-links-opml.php inclusion oracle without attempting command execution...

CVE-2026-79310

webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to an...

CVE-2026-79310

webpy web.py 0.76 is vulnerable to server-side template injection (SSTI) . The vulnerability exists because the template engine can be manipulated into executing attacker-controlled code that bypasses built-in security checks. Specifically, if an application precompiles templates from a directory...

WP < 7.1.2 - Unauthenticated LFI via Page Template Resolution

Description WordPress does not properly validate a request parameter used when resolving page templates in some cases, which could allow unauthenticated attackers to include an existing local PHP file from outside the theme directories, potentially leading to remote code execution depending on th...

ALSA-2026:70640 Important: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a...

Important: skopeo security update

Command line utility to inspect images and repositories directly on Docker registries without the need to pull them. Security Fixes: skopeo: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56858 skopeo: Go encoding/asn1: Denial of Service via excessive recursion in Unmarsha...

ALSA-2026:70641 Important: skopeo security update

Command line utility to inspect images and repositories directly on Docker registries without the need to pull them. Security Fixes: skopeo: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56858 skopeo: Go encoding/asn1: Denial of Service via excessive recursion in Unmarsha...

Important: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a...