TW
Product
Twig
25
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 8High 7Medium 8Low 1
Watch
Add Twig to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-46629 | 6.5 | Jul 14 | Twig: Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments Affected: before 3.26.0 |
| CVE-2026-46627 | 6.5 | Jul 14 | Twig: Sandbox resource exhaustion via unbounded `for` / `range()` Affected: before 3.26.0 |
| CVE-2026-46639 | 6.5 | Jul 14 | Twig: Sandbox property and method bypass via object-destructuring assignment Affected: 3.24.0 before 3.26.0 |
| CVE-2026-47732 | 6.5 | Jul 14 | Twig Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points Affected: before 3.26.0 |
| CVE-2026-46637 | 5.4 | Jul 14 | Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']` Affected: before 3.26.0 |
| CVE-2026-47730 | 5.4 | Jul 14 | Twig: XSS in profiler HtmlDumper via unescaped template and profile names Affected: 3.0.0 before 3.26.0 |
| CVE-2026-46628 | 5.4 | Jul 14 | Twig: The `spaceless` filter implicitly marks its output as safe Affected: before 3.26.0 |
| CVE-2026-46635 | 4.3 | Jul 14 | Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects) Affected: before 3.26.0 |
Showing 8