CVE-2026-75574

CVE-2026-75574 is a remote code execution vulnerability in the Grav Email plugin (getgrav/grav-plugin-email) versions before 4.2.2 . The root cause is that page-editor-controlled Email action parameters are rendered as unsandboxed Twig templates . An authenticated remote user possessing only api....

CVE-2026-75574 Grav before 4.2.2 Remote Code Execution via Email Twig

The Grav Email plugin getgrav/grav-plugin-email before 4.2.2 renders page-editor-controlled Email action parameters as unsandboxed Twig templates. An authenticated remote user with only api.access and api.pages.write permissions can place a Twig expression in header.form.process.email.body, publi...

CVE-2026-72824

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent. The Twig-toggle check uses a bare isSuperAdmin gate that does not consult apikeyscopes, so a least-privilege API key scoped only to api.pages.write and minted on a...

CVE-2026-72782

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets via $ENVVAR strings in the elementId parameter into Twig templates before rendering, even when the Twig sandbox is enabled. An authenticated attacker with control panel access...

EUVD-2026-56106

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets via $ENVVAR strings in the elementId parameter into Twig templates before rendering, even when the Twig sandbox is enabled. An authenticated attacker with control panel access...

CVE-2026-72779

Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability. The create Twig function restricts class instantiation using a 5-entry blocklist that does not include SplFileObject, allowing an authenticated administrator with allowAdminChanges=true to...

CVE-2026-65693 Microweber CMS 2.0.20 Server-Side Template Injection via Mail Templates

Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates. Attackers can exploit the unsandboxed Twig environment in TwigView::render,...

CVE-2026-28496

FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 have a Server-Side Template Injection SSTI vulnerability in the template rendering system. Administrators with access to features that render Twig templates email templates, mass mail campaigns, custo...

EUVD-2026-38455

FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 have a Server-Side Template Injection SSTI vulnerability in the template rendering system. Administrators with access to features that render Twig templates email templates, mass mail campaigns, custo...

Linux Distros Unpatched Vulnerability : CVE-2026-46633

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Twig is a template language for PHP. Prior to 3.26.0, Compiler::string does not escape single quotes when a template name from a % use % tag is placed inside a...

CVE-2026-28784 Craft is affected by potential authenticated Remote Code Execution via Twig SSTI

Craft is a content management system CMS. Prior to 5.8.22 and 4.16.18, it is possible to craft a malicious payload using the Twig map filter in text fields that accept Twig input under Settings in the Craft control panel or using the System Messages utility, which could lead to a RCE. For this to...

GHSA-QC86-Q28F-GGWW Craft CMS has potential authenticated Remote Code Execution via Twig SSTI

For this to work, the attacker must have administrator access to the Craft Control Panel, and allowAdminChanges must be enabled, which is against Craft CMS' recommendations for any non-dev environment. https://craftcms.com/knowledge-base/securing-craftset-allowAdminChanges-to-false-in-production...

Craft CMS has potential authenticated Remote Code Execution via Twig SSTI

For this to work, the attacker must have administrator access to the Craft Control Panel, and allowAdminChanges must be enabled, which is against Craft CMS' recommendations for any non-dev environment. https://craftcms.com/knowledge-base/securing-craftset-allowAdminChanges-to-false-in-production...

CVE-2025-68454

Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated Remote Code Execution via Twig SSTI. For this to work, users must have administrator access to the Craft Control Panel, and...

CVE-2025-68454

CVE-2025-68454 affects Craft CMS: versions 5.0.0-RC1–5.8.20 and 4.0.0-RC1–4.16.16 are vulnerable to authenticated Remote Code Execution via Twig SSTI. The issue requires administrator access to Craft’s Control Panel with allowAdminChanges enabled (or a non-admin with disabled allowAdminChanges bu...

CVE-2025-68454 Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI

Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated Remote Code Execution via Twig SSTI. For this to work, users must have administrator access to the Craft Control Panel, and...

CVE-2025-68454 Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI

Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated Remote Code Execution via Twig SSTI. For this to work, users must have administrator access to the Craft Control Panel, and...

EUVD-2025-25727

Malicious code in bioql PyPI...

CVE-2025-57811

Craft is a platform for creating digital experiences. From versions 4.0.0-RC1 to 4.16.5 and 5.0.0-RC1 to 5.8.6, there is a potential remote code execution vulnerability via Twig SSTI Server-Side Template Injection. This is a follow-up to CVE-2024-52293. This vulnerability has been patched in...

GHSA-CRCQ-738G-PQVC Craft CMS Potential Remote Code Execution via Twig SSTI

Note that users must have administrator access to the Craft Control Panel, and allowAdminChanges must be enabled for this to work, which is against Craft CMS' recommendations for any non-dev environment. https://craftcms.com/knowledge-base/securing-craftset-allowAdminChanges-to-false-in-productio...