151 matches found
foreman: Safemode Bypass leading to RCE
A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution RCE by bypassing the safemode sandbox within the templating engine. Due to improper handling of delegated methods, an attacker can append unauthorized functions to the allowed...
foreman: Safemode Bypass leading to RCE
A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution RCE by bypassing the safemode sandbox within the templating engine. Due to improper handling of delegated methods, an attacker can append unauthorized functions to the allowed...
foreman: Safemode Bypass leading to RCE
A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution RCE by bypassing the safemode sandbox within the templating engine. Due to improper handling of delegated methods, an attacker can append unauthorized functions to the allowed...
CVE-2025-31722
CVE-2025-31722 — Jenkins Templating Engine RCE Solo con fines educativos y de investigación de seguridad autorizada. Descripción Vulnerabilidad de bypass de sandbox en el plugin Jenkins Templating Engine JTE = 2.5.3 que permite a un usuario con pocos privilegios ejecutar código arbitrario en el...
CVE-2026-96658
A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution RCE by bypassing the safemode sandbox within the templating engine. Due to improper handling of delegated methods, an attacker can append unauthorized functions to the allowed...
CVE-2026-96658 Foreman: safemode bypass leading to rce
A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution RCE by bypassing the safemode sandbox within the templating engine. Due to improper handling of delegated methods, an attacker can append unauthorized functions to the allowed...
CVE-2026-96658 Foreman: safemode bypass leading to rce
A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution RCE by bypassing the safemode sandbox within the templating engine. Due to improper handling of delegated methods, an attacker can append unauthorized functions to the allowed...
EUVD-2026-90921
A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution RCE by bypassing the safemode sandbox within the templating engine. Due to improper handling of delegated methods, an attacker can append unauthorized functions to the allowed...
CVE-2026-96658
A flaw in Foreman allows an authenticated attacker with low-level permissions to achieve remote code execution (RCE) . The vulnerability resides in the templating engine 's safemode sandbox , where improper handling of delegated methods enables an attacker to append unauthorized functions to the ...
CVE-2026-96658
A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution RCE by bypassing the safemode sandbox within the templating engine. Due to improper handling of delegated methods, an attacker can append unauthorized functions to the allowed...
foreman: Safemode Bypass leading to RCE
A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution RCE by bypassing the safemode sandbox within the templating engine. Due to improper handling of delegated methods, an attacker can append unauthorized functions to the allowed...
PT-2026-103944
A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution RCE by bypassing the safemode sandbox within the templating engine. Due to improper handling of delegated methods, an attacker can append unauthorized functions to the allowed...
GO-2026-6158 Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings
Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings...
Litestar has HTML Injection Through its CSRF Token
Overview Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie being excluded from automatic escaping by the template engine when configured inline...
PT-2026-48542
Name of the Vulnerable Software and Affected Versions Litestar version 2.21.0 Description Instances using a template engine such as Jinja, Mako, or MiniJinja in conjunction with CSRF protection are susceptible to HTML Injection. This occurs when the application is configured to include CSRF input...
CVE-2026-8080
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in misp allows Stored XSS. This issue affects MISP before 2.5.37. A stored cross-site scripting vulnerability exists in the template element attribute handling logic. The application accepted...
EUVD-2026-28357
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in misp allows Stored XSS. This issue affects MISP before 2.5.37. A stored cross-site scripting vulnerability exists in the template element attribute handling logic. The application accepted...
CVE-2026-8080
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in misp allows Stored XSS. This issue affects MISP before 2.5.37. A stored cross-site scripting vulnerability exists in the template element attribute handling logic. The application accepted...
CVE-2026-8080 MISP core - Stored XSS in MISP template (old engine) element attribute type
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in misp allows Stored XSS. This issue affects MISP before 2.5.37. A stored cross-site scripting vulnerability exists in the template element attribute handling logic. The application accepted...
CVE-2026-8080 MISP core - Stored XSS in MISP template (old engine) element attribute type
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in misp allows Stored XSS. This issue affects MISP before 2.5.37. A stored cross-site scripting vulnerability exists in the template element attribute handling logic. The application accepted...