Medium
CVE-2025-27516
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 58
Reset filters
Medium
CVE-2024-56201
Jinja has a sandbox breakout through malicious filenames
Medium
CVE-2024-56326
Jinja has a sandbox breakout through indirect reference to format method
High
CVE-2024-45053
Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine
High
CVE-2024-41950
Insecure Jinja2 templates rendered in Haystack Components can lead to RCE
High
CVE-2024-37301
document-merge-service vulnerable to Remote Code Execution via Server-Side Template Injection
Medium
CVE-2024-34064
Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
Medium
CVE-2023-6395
Privilege escalation for users that can access mock configuration
Medium
CVE-2024-22195
Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
Critical
CVE-2024-34359
llama-cpp-python vulnerable to Remote Code Execution by Server-Side Template Injection in Model Metadata
Critical
CVE-2024-32651
changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution
Critical
CVE-2025-68664
LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs
Critical
CVE-2026-44182
Jupyter Enterprise Gateway: Kubernetes Manifest Injection in Jinja2 Template Rendering
Critical
CVE-2026-44181
Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection resulting in Remote Code Execution
Critical
CVE-2026-44180
Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids Bypass
High
CVE-2026-44345
BentoML Dockerfile command injection via docker.base_image (sister of pending GHSA-w2pm-x38x-jp44 / CVE-2026-33744 / CVE-2026-35043)
High
CVE-2026-35044
BentoML: SSTI via Unsandboxed Jinja2 in Dockerfile Generation
High
CVE-2026-35043
BentoML: Command Injection in cloud deployment setup script
High
CVE-2026-33744
BentoML has Dockerfile Command Injection via system_packages in bentofile.yaml
High
CVE-2026-33154
dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver
High
CVE-2025-49142
Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configur
Medium
CVE-2024-49377
OctoPrint Vulnerable to Reflected XSS in Jinja2 Templates
High
CVE-2023-25657
Nautobot vulnerable to remote code execution via Jinja2 template rendering
Critical
CVE-2014-4966
Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which allows remote attackers to execute arbitrary code v
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.