TW
Product
Twig
25
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 8High 7Medium 8Low 1
Watch
Add Twig to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-24425 | 9.9 | May 20 | Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface Affected: 2.16.0 through 2.16.1; 3.9.0 before 3.26.0 |
| CVE-2026-46634 | 9.8 | Jul 14 | Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name Affected: 3.9.0 before 3.26.0 |
| CVE-2026-46633 | 9.8 | Jul 14 | Twig: PHP code injection via `{% use %}` template name Affected: before 3.26.0 |
| CVE-2022-23614 | 9.8 | Feb 4 | Twig is an open source template language for PHP Affected: 2.0.0 before 2.14.11; 3.0.0 before 3.3.8 |
| CVE-2018-13818 | 9.8 | Jul 10 | Twig before 2.4.4 allows Server-Side Template Injection (SSTI) via the search search_key parameter Affected: before 2.4.4 |
| CVE-2026-48807 | 9.1 | Jul 14 | Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters Affected: before 3.27.0 |
| CVE-2026-48806 | 9.1 | Jul 14 | Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys Affected: before 3.27.0 |
| CVE-2026-48805 | 9.1 | Jul 14 | Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php` Affected: before 3.27.0 |
Showing 8