CVE-2026-89094
Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/templat
CVSS
9.9
Critical
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Sep 10, 2026 · Last modified: Sep 10, 2026 · CWE-1336
Not enough EPSS history yet.
Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-91604.3 MED—
———Improper neutralization of special elements used in a template engine vulnerability in Arma Digital Media Inc. Website Template allows Code Injection.
This issue affects Website Template: through 11092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.3hCVE-2026-195847.7 HIG8.7%
——3Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOK_EDITOR permission to plant a VQL query which will be evaluated at elevated permissions if the notebook's backup is subsequently restored.17hCVE-2026-870217.2 HIG30.3%
——9Tanium addressed an unauthorized code execution vulnerability in Comply.2dCVE-2026-333874.6 MED7.4%
——2A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated user with the required privileges can define a dashboard containing a malicious payload, or a victim can be socially engineered into importing a malicious dashboard. When the victim views or imports the dashboard, the payload executes in their browser context, allowing the attacker to modify application data or disrupt application availability.3dCVE-2026-7565010.0 CRI81.0%
KEV—74Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability3dCVE-2026-52762—37.8%
——11YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki Bazar contains a stored Server-Side Template Injection (SSTI) vulnerability in the semantic template feature that can be escalated to confirmed Remote Code Execution (RCE). An authenticated administrator can place arbitrary Twig expressions into the Semantic template (Twig) field (bn_sem_template), and that content is later executed server-side when public semantic endpoints are requested. This issue has been patched in version 4.6.6.3d