EUVD-2026-56103

Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability. The create Twig function restricts class instantiation using a 5-entry blocklist that does not include SplFileObject, allowing an authenticated administrator with allowAdminChanges=true to...

GHSA-596P-6JV8-775V Craft CMS: Authenticated leak of secret environment variables

Environment variables and secrets are interpolated into a Twig template even when the Twig sandbox is enabled, allowing them to be leaked by an authenticated attacker. The Craft vulnerability CVE-2026-31857 was only patched by applying sandboxed Twig templating. This theoretically protects Craft...

1dr-twig-templating (1.0.2), 433bf (0.0.1) +946 more potentially affected by CVE-2026-29091 via locutus (>=2.0.10, <=2.0.39)

locutus NPM version =2.0.10, =0.0.1, =0.0.1, =1.0.2, =1.0.5, =0.0.1, =0.1.0, =1.0.0, =0.2.0, =0.9.0-rc.0 - @alchmy/generator-alchmy 0.0.206147191 and more Source cves: CVE-2026-29091 Source advisory: MEND:CVE-2026-29091...