TW
Product
Twig
20
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 6High 6Medium 8Low 0
Watch
Add Twig to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-46640 | 8.8 | Jul 14 | Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation Affected: >= 3.15.0, < 3.26.0 |
| CVE-2026-46636 | 8.7 | Sep 4 | Twig: Sandbox method allowlist bypass via `Markup` subclass Affected: >= 1.0.0, < 3.27.0 |
| CVE-2024-45411 | 8.6 | Sep 9 | Twig has a possible sandbox bypass Affected: > 1.0.0, < 1.44.8; > 2.0.0, < 2.16.1; > 3.0.0, < 3.14.0 |
| CVE-2026-49981 | 8.2 | Jul 14 | Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template` Affected: < 3.27.0 |
| CVE-2026-46638 | 8.1 | Jul 14 | Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411) Affected: < 3.26.0 |
| CVE-2026-48808 | 7.5 | Jul 14 | Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface` Affected: < 3.27.0 |
Showing 6