Known Vulnerabilities for Twig by Twigphp
Listed below are 10 of the newest known vulnerabilities associated with "Twig" by "Twigphp".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-86197 json | Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and addCss ... | Not Provided | 2026-09-05 | 2026-09-10 |
| CVE-2026-85604 json | Grav before 2.0.18 (affected versions <= 2.0.17) contains a remote code execution vulnerability in the Twig sort filter. The ... | Not Provided | 2026-09-04 | 2026-09-08 |
| CVE-2026-85598 json | Grav versions 2.0.0 through 2.0.17 fail to apply save-time XSS detection to modular pages, allowing authenticated page editor... | Not Provided | 2026-09-04 | 2026-09-14 |
| CVE-2026-80201 json | Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getAp... | Not Provided | 2026-08-26 | 2026-08-26 |
| CVE-2026-80198 json | Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and export templates, allowing ... | Not Provided | 2026-08-26 | 2026-08-28 |
| CVE-2026-79988 json | The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to aut... | Not Provided | 2026-08-27 | 2026-08-28 |
| CVE-2026-79774 json | Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\\Twig\\Security... | Not Provided | 2026-08-25 | 2026-08-26 |
| CVE-2026-76846 json | Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to sy... | Not Provided | 2026-08-25 | 2026-08-27 |
| CVE-2026-76839 json | Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet() and offse... | Not Provided | 2026-08-25 | 2026-08-25 |
| CVE-2026-75837 json | Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restr... | Not Provided | 2026-08-18 | 2026-08-19 |