{"items":[{"id":"CVE-2026-82531","published":"2026-10-06T12:18:31.801Z","updated":"2026-10-06T12:47:10.950Z","title":"Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache","severity":"CRITICAL","score":9.2,"vendor":"smarty-php","product":"smarty","kev":false,"epss":0.00821,"kevAdded":null,"exploit":true},{"id":"CVE-2026-62993","published":"2026-08-31T20:58:03.616Z","updated":"2026-09-02T17:36:30.257Z","title":"Smarty: SSRF via redirect bypass of trusted_uri using {fetch}","severity":"MEDIUM","score":6.9,"vendor":"smarty-php","product":"smarty","kev":false,"epss":0.00574,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62996","published":"2026-08-07T15:04:52.662Z","updated":"2026-08-07T17:08:09.710Z","title":"Smarty Security stream restriction bypass through stream: resource","severity":"MEDIUM","score":6.9,"vendor":"smarty-php","product":"smarty","kev":false,"epss":0.00508,"kevAdded":null,"exploit":true},{"id":"CVE-2026-62992","published":"2026-08-07T15:02:28.873Z","updated":"2026-08-07T16:00:28.634Z","title":"Smarty: Symlink path traversal out of trusted directories","severity":"MEDIUM","score":6.9,"vendor":"smarty-php","product":"smarty","kev":false,"epss":0.00533,"kevAdded":null,"exploit":false},{"id":"CVE-2024-35226","published":"2024-05-28T20:55:00.884Z","updated":"2025-11-03T21:54:58.981Z","title":"PHP Code Injection by malicious attribute in extends-tag in Smarty","severity":"HIGH","score":7.3,"vendor":"smarty-php","product":"smarty","kev":false,"epss":0.00507,"kevAdded":null,"exploit":false},{"id":"CVE-2023-28447","published":"2023-03-28T20:07:39.103Z","updated":"2025-11-03T21:47:36.097Z","title":"Cross site scripting vulnerability in Javascript escaping in smarty/smarty","severity":"HIGH","score":7.1,"vendor":"smarty-php","product":"smarty","kev":false,"epss":0.01016,"kevAdded":null,"exploit":false},{"id":"CVE-2022-29221","published":"2022-05-24T00:00:00.000Z","updated":"2025-04-23T18:22:54.999Z","title":"PHP Code Injection by malicious block or filename in Smarty","severity":"HIGH","score":8.8,"vendor":"smarty-php","product":"smarty","kev":false,"epss":0.04914,"kevAdded":null,"exploit":false},{"id":"CVE-2021-29454","published":"2022-01-10T00:00:00.000Z","updated":"2025-04-23T19:14:05.629Z","title":"Sandbox Escape by math function in smarty","severity":"HIGH","score":8.1,"vendor":"smarty-php","product":"smarty","kev":false,"epss":0.01861,"kevAdded":null,"exploit":false},{"id":"CVE-2021-21408","published":"2022-01-10T00:00:00.000Z","updated":"2025-04-23T19:14:12.719Z","title":"Access to restricted PHP code by dynamic static class access in smarty","severity":"HIGH","score":8.8,"vendor":"smarty-php","product":"smarty","kev":false,"epss":0.02143,"kevAdded":null,"exploit":false}]}