TW
Product
Twig
25
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 8High 7Medium 8Low 1
Watch
Add Twig to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-46640 | 8.8 | Jul 14 | Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation Affected: 3.15.0 before 3.26.0 |
| CVE-2024-45411 | 8.6 | Sep 9 | Twig has a possible sandbox bypass Affected: 1.0.0 before 1.44.8; 2.0.0 before 2.16.1; 3.0.0 before 3.14.0 |
| CVE-2026-49981 | 8.2 | Jul 14 | Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template` Affected: before 3.27.0 |
| CVE-2026-46638 | 8.1 | Jul 14 | Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411) Affected: before 3.26.0 |
| CVE-2026-48808 | 7.5 | Jul 14 | Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface` Affected: before 3.27.0 |
| CVE-2022-39261 | 7.5 | Sep 28 | Twig may load a template outside a configured directory when using the filesystem loader Affected: 1.0.0 before 1.44.7; 2.0.0 before 2.15.3; 3.0.0 before 3.4.3 |
| CVE-2001-1537 | 7.5 | Dec 31 | The default "basic" security setting' in config.php for TWIG webmail 2.7.4 and earlier stores cleartext usernames and passwords in cookies, which could allow attackers to obtain… Affected: through 2.7.4 |
Showing 7