erb: ERB: Arbitrary code execution via deserialization bypass

A flaw was found in ERB, a templating system for Ruby. An attacker who can trigger deserialization of untrusted data in a Ruby application can bypass existing protections. This vulnerability allows for arbitrary code execution by exploiting specific public methods that evaluate template source...

CVE-2026-11769

A flaw was found in the Grafana Operator. This vulnerability allows a malicious user, who can create Dashboard or LibraryPanel resources for a Grafana instance, to exploit a path traversal issue within the jsonnet data templating language. This exploitation can lead to privilege escalation and...

Zope allows attackers to modify raw image and file data

Zope 2.2.0 through 2.2.4 does not properly protect a data updating method on Image and File objects, which allows attackers with DTML editing privileges to modify the raw data of these objects...

erb: ERB: Arbitrary code execution via deserialization bypass

A flaw was found in ERB, a templating system for Ruby. An attacker who can trigger deserialization of untrusted data in a Ruby application can bypass existing protections. This vulnerability allows for arbitrary code execution by exploiting specific public methods that evaluate template source...

Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection resulting in Remote Code Execution

SummaryThe environment variables KERNELXXX used during the rendering of the Kubernetes manifest are vulnerable to Server Side Template Injection SSTI.By including Jinja2 template expressions it is possible to execution Python code and OS Commands in the Enterprise Gateway service.The code can use...

PT-2026-53311

Name of the Vulnerable Software and Affected Versions Snowflake CLI versions prior to 3.19 Description Improper restriction of file path resolution allows arbitrary local file content to be read and transmitted to Snowflake services. An attacker can exploit this by providing crafted repository or...

PT-2026-53472

BerriAI/litellm is vulnerable to Server-Side Template Injection SSTI via the /completions endpoint. The vulnerability arises from the hf chat template method processing the chat template parameter from the tokenizer config.json file through the Jinja template engine without proper sanitization...

org.jenkins-ci.plugins:templating-engine (>=2.2, <=2.5.3) potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1.76)

org.jenkins-ci.plugins:script-security MAVEN version 1.76 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:templating-engine =2.2, =2.5.3 Source cves: CVE-2026-57281...

org.jenkins-ci.plugins:templating-engine (>=2.3, <=2.5.3) potentially affected by CVE-2026-57282 via org.jenkins-ci.plugins:git-client (3.2.1)

org.jenkins-ci.plugins:git-client MAVEN version 3.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git-client and may be impacted: - org.jenkins-ci.plugins:templating-engine =2.3, =2.5.3 Source cves: CVE-2026-57282 Source...

org.jenkins-ci.plugins:templating-engine (>=1.6, <=2.1) potentially affected by CVE-2026-57280 via org.jenkins-ci.plugins:script-security (1.42)

org.jenkins-ci.plugins:script-security MAVEN version 1.42 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:templating-engine =1.6, =2.1 Source cves: CVE-2026-57280 Sour...

org.jenkins-ci.plugins:templating-engine (>=2.2, <=2.5.3) potentially affected by CVE-2026-57280 via org.jenkins-ci.plugins:script-security (1.76)

org.jenkins-ci.plugins:script-security MAVEN version 1.76 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:templating-engine =2.2, =2.5.3 Source cves: CVE-2026-57280...

org.jenkins-ci.plugins:templating-engine (>=1.6, <=2.2.1.1) potentially affected by CVE-2026-57285 via org.jenkins-ci.plugins:github-branch-source (2.5.1)

org.jenkins-ci.plugins:github-branch-source MAVEN version 2.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:github-branch-source and may be impacted: - org.jenkins-ci.plugins:templating-engine =1.6, =2.2.1.1 Source cves:...

TencentOS Server 3: ruby:3.3 (TSSA-2026:0546)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0546 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

Operator - Namespaced User Path Traversal

We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator. The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating language...

Litestar has HTML Injection Through its CSRF Token

Overview Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie being excluded from automatic escaping by the template engine when configured inline...

PT-2026-48542

Name of the Vulnerable Software and Affected Versions Litestar version 2.21.0 Description Instances using a template engine such as Jinja, Mako, or MiniJinja in conjunction with CSRF protection are susceptible to HTML Injection. This occurs when the application is configured to include CSRF input...

CVE-2026-6169

The affiliate-toolkit plugin for WordPress is vulnerable to remote code execution in all versions up to, and including, 3.8.5. This is due to the plugin using the BladeOne templating engine's runString method which compiles user-supplied template content into PHP code and executes it via eval...

CVE-2026-2587

A critical Remote Code Execution RCE vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression Language EL “expressions” are processed...

CVE-2026-42360

A bug in Apache Airflow's rendered-template field handling caused nested sensitive-key masking e.g. nested password / token / secret / apikey keys inside a JSON template structure to be bypassed when the rendered field exceeded core maxtemplatedfieldlength: Airflow stringified the structure befor...

CVE-2026-42360

A bug in Apache Airflow 's rendered-template field handling allows an authenticated UI/API user to bypass nested sensitive-key masking. When a rendered field exceeds [core] max_templated_field_length, the system stringifies the structure before redaction, causing it to lose nested key context (e....