https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T07:58:01.031557+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-46640 CVE-2026-46640 — Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation 2026-10-06T07:58:01.033400+00:00

Affected: twigphp Twig

Twig is a template language for PHP. From 3.15.0 until 3.26.0, _self.(<string>) and import-alias dynamic attribute syntax can concatenate an attacker-controlled string into a MacroReferenceExpression name without identifier validation, causing raw PHP to be emitted into the generated template source and executed at template-load time. This issue is fixed in version 3.26.0.