{"items":[{"id":"CVE-2026-46636","published":"2026-09-04T22:07:35.122Z","updated":"2026-09-08T17:38:45.651Z","title":"Twig: Sandbox method allowlist bypass via `Markup` subclass","severity":"HIGH","score":8.7,"vendor":"twigphp","product":"Twig","kev":false,"epss":0.0057,"kevAdded":null},{"id":"CVE-2026-48807","published":"2026-07-14T21:29:15.934Z","updated":"2026-07-15T12:50:42.588Z","title":"Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters","severity":"HIGH","score":7.1,"vendor":"twigphp","product":"Twig","kev":false,"epss":0.00367,"kevAdded":null},{"id":"CVE-2026-48806","published":"2026-07-14T21:28:08.781Z","updated":"2026-07-15T12:47:14.623Z","title":"Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys","severity":"HIGH","score":7.1,"vendor":"twigphp","product":"Twig","kev":false,"epss":0.00418,"kevAdded":null},{"id":"CVE-2026-48808","published":"2026-07-14T21:27:21.812Z","updated":"2026-07-15T14:31:58.897Z","title":"Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`","severity":"MEDIUM","score":6,"vendor":"twigphp","product":"Twig","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2026-48805","published":"2026-07-14T21:26:34.876Z","updated":"2026-07-16T15:09:20.665Z","title":"Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`","severity":"MEDIUM","score":5.3,"vendor":"twigphp","product":"Twig","kev":false,"epss":0.00483,"kevAdded":null},{"id":"CVE-2026-49981","published":"2026-07-14T21:26:00.460Z","updated":"2026-07-21T14:57:52.032Z","title":"Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`","severity":"MEDIUM","score":6,"vendor":"twigphp","product":"Twig","kev":false,"epss":0.00362,"kevAdded":null},{"id":"CVE-2026-46637","published":"2026-07-14T21:25:20.141Z","updated":"2026-07-16T15:05:57.087Z","title":"Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`","severity":"MEDIUM","score":5.1,"vendor":"twigphp","product":"Twig","kev":false,"epss":0.00305,"kevAdded":null},{"id":"CVE-2026-46638","published":"2026-07-14T21:23:50.961Z","updated":"2026-07-15T12:48:08.554Z","title":"Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)","severity":"MEDIUM","score":6,"vendor":"twigphp","product":"Twig","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-46640","published":"2026-07-14T21:22:57.332Z","updated":"2026-07-16T03:55:34.985Z","title":"Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation","severity":"HIGH","score":8.7,"vendor":"twigphp","product":"Twig","kev":false,"epss":0.00642,"kevAdded":null},{"id":"CVE-2026-46629","published":"2026-07-14T21:22:15.595Z","updated":"2026-07-15T12:53:13.636Z","title":"Twig: Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments","severity":"MEDIUM","score":5.3,"vendor":"twigphp","product":"Twig","kev":false,"epss":0.00542,"kevAdded":null},{"id":"CVE-2026-47730","published":"2026-07-14T21:21:10.185Z","updated":"2026-07-21T14:45:11.407Z","title":"Twig: XSS in profiler HtmlDumper via unescaped template and profile names","severity":"MEDIUM","score":5.1,"vendor":"twigphp","product":"Twig","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2026-46628","published":"2026-07-14T21:19:54.501Z","updated":"2026-07-15T12:49:21.254Z","title":"Twig: The `spaceless` filter implicitly marks its output as safe","severity":"MEDIUM","score":5.1,"vendor":"twigphp","product":"Twig","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2026-46634","published":"2026-07-14T21:19:17.804Z","updated":"2026-07-29T18:26:17.523Z","title":"Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name","severity":"HIGH","score":7.7,"vendor":"twigphp","product":"Twig","kev":false,"epss":0.00616,"kevAdded":null},{"id":"CVE-2026-46627","published":"2026-07-14T21:15:17.366Z","updated":"2026-07-16T15:03:37.558Z","title":"Twig: Sandbox resource exhaustion via unbounded `for` / `range()`","severity":"HIGH","score":7.1,"vendor":"twigphp","product":"Twig","kev":false,"epss":0.00542,"kevAdded":null},{"id":"CVE-2026-46633","published":"2026-07-14T21:14:24.916Z","updated":"2026-11-04T00:01:29.155Z","title":"Twig: PHP code injection via `{% use %}` template name","severity":"HIGH","score":8.7,"vendor":"twigphp","product":"Twig","kev":false,"epss":0.00774,"kevAdded":null},{"id":"CVE-2026-46639","published":"2026-07-14T21:13:42.321Z","updated":"2026-07-15T12:54:34.864Z","title":"Twig: Sandbox property and method bypass via object-destructuring assignment","severity":"HIGH","score":7.1,"vendor":"twigphp","product":"Twig","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2026-46635","published":"2026-07-14T21:12:56.046Z","updated":"2026-07-15T13:26:27.106Z","title":"Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)","severity":"MEDIUM","score":5.3,"vendor":"twigphp","product":"Twig","kev":false,"epss":0.00331,"kevAdded":null},{"id":"CVE-2026-47732","published":"2026-07-14T21:12:13.071Z","updated":"2026-07-15T13:26:33.236Z","title":"Twig Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points","severity":"HIGH","score":7.1,"vendor":"twigphp","product":"Twig","kev":false,"epss":0.00402,"kevAdded":null},{"id":"CVE-2026-24425","published":"2026-05-20T13:45:02.413Z","updated":"2026-10-08T15:22:18.580Z","title":"Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface","severity":"HIGH","score":8.7,"vendor":"twigphp","product":"Twig","kev":false,"epss":0.00758,"kevAdded":null},{"id":"CVE-2025-24374","published":"2025-01-29T15:22:34.012Z","updated":"2025-01-29T15:44:49.358Z","title":"Twig fixes a security issue where escaping was missing when using null coalesce operator (??)","severity":"MEDIUM","score":4.3,"vendor":"twigphp","product":"Twig","kev":false,"epss":0.00298,"kevAdded":null},{"id":"CVE-2024-51754","published":"2024-11-06T19:28:17.553Z","updated":"2025-05-29T09:03:17.579Z","title":"Unguarded calls to __toString() when nesting an object into an array in Twig","severity":"LOW","score":2.2,"vendor":"twigphp","product":"Twig","kev":false,"epss":0.00431,"kevAdded":null},{"id":"CVE-2024-51755","published":"2024-11-06T19:27:05.347Z","updated":"2024-11-07T15:12:59.408Z","title":"Unguarded calls to __isset() and to array-accesses when the sandbox is enabled in Twig","severity":"LOW","score":2.2,"vendor":"twigphp","product":"Twig","kev":false,"epss":0.00425,"kevAdded":null},{"id":"CVE-2024-45411","published":"2024-09-09T18:20:28.363Z","updated":"2024-09-16T12:04:18.107Z","title":"Twig has a possible sandbox bypass","severity":"HIGH","score":8.6,"vendor":"twigphp","product":"Twig","kev":false,"epss":0.00849,"kevAdded":null},{"id":"CVE-2022-39261","published":"2022-09-28T00:00:00.000Z","updated":"2025-04-23T16:54:59.321Z","title":"Twig may load a template outside a configured directory when using the filesystem loader","severity":"HIGH","score":7.5,"vendor":"twigphp","product":"Twig","kev":false,"epss":0.03174,"kevAdded":null},{"id":"CVE-2022-23614","published":"2022-02-04T22:25:11.000Z","updated":"2025-04-23T19:08:27.990Z","title":"Code injection in Twig","severity":"HIGH","score":8.8,"vendor":"twigphp","product":"Twig","kev":false,"epss":0.08209,"kevAdded":null}]}