https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T03:48:02.687613+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-46634 CVE-2026-46634 — Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name 2026-10-07T03:48:02.689281+00:00

Affected: twigphp Twig

Twig is a template language for PHP. From 3.9.0 until 3.26.0, template_from_string() compiles an inner template under a synthesized __string_template__<hash> name that can fall outside a SourcePolicyInterface sandbox decision, allowing a sandboxed template that can call template_from_string and include to render an inner template without security policy enforcement. This issue is fixed in version 3.26.0.