| [CVE-2026-48808] Twig is a template language for PHP. Prior to 3.27.0, the column filter passes the active sandbox state as a boolean but does not forward the current Source to SandboxExtension::checkPropertyAllowed() | Medium(6) | Non interessataDettagli (2)3.5.1-1+deb12u3 · all · bookworm-security
Non interessata nvd · php-twig · debian · bookworm 3.5.1-1+deb12u3 · all · bookworm-security
Non interessata nvd · php-twig · debian · bookworm
|
| [CVE-2026-48807] Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully cover Traversable values passed to join and replace filters or operands evaluated by the in and not i | High(7.1) | Non interessataDettagli (2)3.5.1-1+deb12u3 · all · bookworm-security
Non interessata nvd · php-twig · debian · bookworm 3.5.1-1+deb12u3 · all · bookworm-security
Non interessata nvd · php-twig · debian · bookworm
|
| [CVE-2026-48806] Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allowing PHP to invoke __toString() on a Stringable object used a | High(7.1) | Non interessataDettagli (2)3.5.1-1+deb12u3 · all · bookworm-security
Non interessata nvd · php-twig · debian · bookworm 3.5.1-1+deb12u3 · all · bookworm-security
Non interessata nvd · php-twig · debian · bookworm
|
| [CVE-2026-47730] Twig is a template language for PHP. From 3.0.0 until 3.26.0, Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate() and Profile::getName() into HTML output without escaping, allowing attacker- | Medium(5.1) | CorrettaDettagli (2)3.5.1-1+deb12u3 · all · bookworm-security
Corretta · Corretta: 3.5.1-1+deb12u3 nvd · php-twig · debian · bookworm; nvd · php-twig · debian · 12 3.5.1-1+deb12u3 · all · bookworm-security
Corretta · Corretta: 3.5.1-1+deb12u3 nvd · php-twig · debian · bookworm; nvd · php-twig · debian · 12
|
| [CVE-2026-46640] Twig is a template language for PHP. From 3.15.0 until 3.26.0, _self.(<string>) and import-alias dynamic attribute syntax can concatenate an attacker-controlled string into a MacroReferenceExpression | High(8.7) | Non interessataDettagli (2)3.5.1-1+deb12u3 · all · bookworm-security
Non interessata nvd · php-twig · debian · bookworm 3.5.1-1+deb12u3 · all · bookworm-security
Non interessata nvd · php-twig · debian · bookworm
|
| [CVE-2026-46639] Twig is a template language for PHP. From 3.24.0 until 3.26.0, object-destructuring assignment compiles CoreExtension::getAttribute() with the sandbox argument hardcoded to false, disabling property a | High(7.1) | Non interessataDettagli (2)3.5.1-1+deb12u3 · all · bookworm-security
Non interessata nvd · php-twig · debian · bookworm 3.5.1-1+deb12u3 · all · bookworm-security
Non interessata nvd · php-twig · debian · bookworm
|
| [CVE-2026-46637] Twig is a template language for PHP. Prior to 3.26.0, several filters in twig/markdown-extra and twig/cssinliner-extra are registered with is_safe => [all], causing Twig to treat plain text or HTML ou | Medium(5.1) | CorrettaDettagli (2)3.5.1-1+deb12u3 · all · bookworm-security
Corretta · Corretta: 3.5.1-1+deb12u3 nvd · php-twig · debian · bookworm; nvd · php-twig · debian · 12 3.5.1-1+deb12u3 · all · bookworm-security
Corretta · Corretta: 3.5.1-1+deb12u3 nvd · php-twig · debian · bookworm; nvd · php-twig · debian · 12
|
| [CVE-2026-46634] Twig is a template language for PHP. From 3.9.0 until 3.26.0, template_from_string() compiles an inner template under a synthesized __string_template__<hash> name that can fall outside a SourcePolicyI | High(7.7) | Non interessataDettagli (2)3.5.1-1+deb12u3 · all · bookworm-security
Non interessata nvd · php-twig · debian · bookworm 3.5.1-1+deb12u3 · all · bookworm-security
Non interessata nvd · php-twig · debian · bookworm
|
| [CVE-2026-46633] Twig is a template language for PHP. Prior to 3.26.0, Compiler::string() does not escape single quotes when a template name from a {% use %} tag is placed inside a PHP single-quoted string literal, al | High(8.7) | CorrettaDettagli (2)3.5.1-1+deb12u3 · all · bookworm-security
Corretta · Corretta: 3.5.1-1+deb12u3 nvd · php-twig · debian · bookworm; nvd · php-twig · debian · 12 3.5.1-1+deb12u3 · all · bookworm-security
Corretta · Corretta: 3.5.1-1+deb12u3 nvd · php-twig · debian · bookworm; nvd · php-twig · debian · 12
|
| [CVE-2026-46629] Twig is a template language for PHP. Prior to 3.26.0, twig/intl-extra memoises IntlDateFormatter and NumberFormatter instances in arrays keyed by template-controlled filter arguments such as locale, p | Medium(5.3) | CorrettaDettagli (2)3.5.1-1+deb12u3 · all · bookworm-security
Corretta · Corretta: 3.5.1-1+deb12u3 nvd · php-twig · debian · bookworm; nvd · php-twig · debian · 12 3.5.1-1+deb12u3 · all · bookworm-security
Corretta · Corretta: 3.5.1-1+deb12u3 nvd · php-twig · debian · bookworm; nvd · php-twig · debian · 12
|
| [CVE-2026-46628] Twig is a template language for PHP. Prior to 3.26.0, the deprecated spaceless filter is registered as safe for HTML, causing Twig autoescaping to emit attacker-controlled markup unescaped when spacel | Medium(5.1) | CorrettaDettagli (2)3.5.1-1+deb12u3 · all · bookworm-security
Corretta · Corretta: 3.5.1-1+deb12u3 nvd · php-twig · debian · bookworm; nvd · php-twig · debian · 12 3.5.1-1+deb12u3 · all · bookworm-security
Corretta · Corretta: 3.5.1-1+deb12u3 nvd · php-twig · debian · bookworm; nvd · php-twig · debian · 12
|
| [CVE-2026-24425] Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerability when using a SourcePolicyInterface that allows attackers with template rendering capabilities to pass arbitrary PHP | High(8.7) | Non interessataDettagli (2)3.5.1-1+deb12u3 · all · bookworm-security
Non interessata nvd · php-twig · debian · bookworm 3.5.1-1+deb12u3 · all · bookworm-security
Non interessata nvd · php-twig · debian · bookworm
|
| [CVE-2022-39261] php-twig: CVE-2022-39261 | Medium | CorrettaDettagli (2)3.5.1-1+deb12u3 · all · bookworm-security
Corretta · Corretta: 3.4.3-1 dsa · php-twig · debian · bookworm 3.5.1-1+deb12u3 · all · bookworm-security
Corretta · Corretta: 3.4.3-1 dsa · php-twig · debian · bookworm
|
