Login Request a demo
TW
Product
Twig
by twigphp · last CVE Sep 4, 2026
20
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Vulnerabilities20In the news0Timeline
Severity mix
Critical 6High 6Medium 8Low 0
Severity
All severities20Critical6High6Medium8Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Twig to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-24425
9.9
1%
May 20
Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface
Affected: 3.9.0 before 3.26.0; 2.16.*
CVE-2026-46634
9.8
1%
Jul 14
Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name
Affected: >= 3.9.0, < 3.26.0
CVE-2026-46633
9.8
1%
Jul 14
Twig: PHP code injection via `{% use %}` template name
Affected: < 3.26.0
CVE-2026-48807
9.1
0%
Jul 14
Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters
Affected: < 3.27.0
CVE-2026-48806
9.1
0%
Jul 14
Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys
Affected: < 3.27.0
CVE-2026-48805
9.1
0%
Jul 14
Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`
Affected: < 3.27.0
Showing 6