https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T06:57:18.148896+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-06075 bdu:2025-06075 2026-10-05T06:57:18.152529+00:00 bdu:2025-06075 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0836 certfr-2025-avi-0836 — De multiples vulnérabilités ont été découvertes dans Tenable Security Center. Elles permettent à un attaquant de provoq… 2026-10-05T06:57:18.152561+00:00 certfr-2025-avi-0836 https://cve.radiocsirt.org/vuln/euvd-2026-163322 EUVD-2026-163322 2026-10-05T06:57:18.152579+00:00 EUVD-2026-163322 https://cve.radiocsirt.org/vuln/fkie_cve-2024-45411 fkie_cve-2024-45411 2026-10-05T06:57:18.152591+00:00

Twig is a template language for PHP. Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions. This vulnerability is fixed in 1.44.8, 2.16.1, and 3.14.0.

 https://cve.radiocsirt.org/vuln/ghsa-6j75-5wfj-gh66 GHSA-6j75-5wfj-gh66 — Twig has a possible sandbox bypass 2026-10-05T06:57:18.152618+00:00

Affected: Packagist: twig/twig

### Description

Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions.

The security issue happens when all these conditions are met:

* The sandbox is disabled globally; * The sandbox is enabled via a sandboxed `include()` function which references a template name (like `included.twig`) and not a `Template` or `TemplateWrapper` instance; * The included template has been loaded before the `include()` call but in a non-sandbox context (possible as the sandbox has been globally disabled).

### Resolution

The patch ensures that the sandbox security checks are always run at runtime.

### Credits

We would like to thank Fabien Potencier for reporting and fixing the issue.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-45411 UBUNTU-CVE-2024-45411 2026-10-05T06:57:18.152649+00:00

Affected: Ubuntu:Pro:16.04:LTS: twig, Ubuntu:Pro:18.04:LTS: twig, Ubuntu:Pro:20.04:LTS: php-twig, Ubuntu:Pro:22.04:LTS: php-twig, Ubuntu:24.04:LTS: php-twig, Ubuntu:Pro:24.04:LTS: php-twig

Twig is a template language for PHP. Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions. This vulnerability is fixed in 1.44.8, 2.16.1, and 3.14.0.