By weakness (CWE)

CWE-1336: related vulnerabilities

CVEs classified under CWE-1336. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

3 published vulnerabilities

• CVE-2026-11407HIGH 7.2

  Pimcore CMS/DXP version 12.3.8 has a critical flaw in its Twig template security controls that allows authenticated administrators to bypass sandboxing restrictions. An attacker with admin credentials can inject malicious Twig code through the DataObject ClassDefinition component to read files, execute database queries, or potentially run arbitrary code on the server. This is a privilege-escalation risk for environments where admins should have limited template capabilities, or where templates are user-generated.

• CVE-2026-49382MEDIUM 4.5

  A vulnerability in JetBrains IntelliJ IDEA's Copyright plugin allows an attacker to execute code on a developer's machine through template injection. The attack requires local access and user interaction—specifically, a developer must open a malicious project or file. While the severity is moderate, this poses a real risk in shared development environments or when developers download untrusted projects.

• CVE-2026-52796LOW 3.5

  Gogs, a self-hosted Git service, contains a denial-of-service vulnerability in how it renders issue index patterns. If an administrator configures an issue pattern with unmatched braces (an opening { without a closing }), the application crashes whenever a user views any page containing an issue reference like #1. This renders affected repositories inaccessible. The flaw stems from unsafe string handling in the pattern rendering code. Authenticated users with repository access can trigger the crash by simply viewing pages, though the vulnerability requires the misconfigured pattern to be in place first.