# CWE-791. Every Advisory and CVE whose sources give the weakness CWE-791, newest first. ## Records, newest first - [eosphoros-ai DB-GPT Jinja2 Template \_\_init\_\_.py FileBasedSkill.get_prompt special elements in template engine](https://agentprime.io/advisories/CVE-2026-123020.md) `CVE-2026-123020` · CVE record: eosphoros-ai DB-GPT · CVSS 5.3 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Code injection, CWE-791 - [svg-sanitizer 0.5.0 before 1.1.0 Incomplete url() Filtering in SVG Attributes](https://agentprime.io/advisories/CVE-2026-121446.md) `CVE-2026-121446` · CVE record: darylldoyle svg-sanitizer · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-791 - [Furion .NET Framework View ViewEngine.cs RunCompile special elements in template engine](https://agentprime.io/advisories/CVE-2026-108570.md) `CVE-2026-108570` · CVE record: Furion .NET Framework · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Code injection, CWE-791 - [formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engine](https://agentprime.io/advisories/CVE-2026-103540.md) `CVE-2026-103540` · CVE record: formtools.org Form Tools · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Code injection, CWE-791 - [Naichen ThinkCMF Email Template MailController.php templatePut special elements in template engine](https://agentprime.io/advisories/CVE-2026-102771.md) `CVE-2026-102771` · CVE record: Naichen ThinkCMF · CVSS 5.1 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Code injection, CWE-791 - [Access control filter bypass allows unauthorised access to APIs](https://agentprime.io/advisories/CVE-2026-86206.md) `CVE-2026-86206` · CVE record: N-able N-central · CVSS 6.9 Medium · Not analysed yet · Published 5 Sept 2026 · Tags: CWE-791 - [Dromara UJCMS web-file-template Endpoint WebFileTemplateController.java update special elements in template engine](https://agentprime.io/advisories/CVE-2026-78140.md) `CVE-2026-78140` · CVE record: Dromara UJCMS · CVSS 5.1 Medium · Not analysed yet · Published 23 Aug 2026 · Tags: Code injection, CWE-791 - [xianrendzw EasyReport SQL Preview Endpoint DesignerController.java previewSqlText special elements in template engine](https://agentprime.io/advisories/CVE-2026-75979.md) `CVE-2026-75979` · CVE record: xianrendzw EasyReport · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Code injection, CWE-791 - [OpenBoxes Template Processing DocumentController.groovy buildZebraTemplate special elements in template engine](https://agentprime.io/advisories/CVE-2026-19929.md) `CVE-2026-19929` · CVE record: OpenBoxes · CVSS 5.3 Medium · Not analysed yet · Published 16 Aug 2026 · Tags: Code injection, CWE-791 - [langgenius dify Jinja2 jinja2_transformer.py jinja2.Template special elements used in a template engine](https://agentprime.io/advisories/CVE-2026-18632.md) `CVE-2026-18632` · CVE record: langgenius dify · CVSS 5.3 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: Code injection, CWE-791 - [Angular's deprecated package has a Cross-Site Scripting issue](https://agentprime.io/advisories/GHSA-7x27-g8rg-x87w.md) `GHSA-7x27-g8rg-x87w`, `CVE-2026-11998` · npm `angular`: affected `>=1.2.0-rc.3, <=1.8.3`, no fixed version yet · CVSS 7.6 High · Not analysed yet · Published 24 Jun 2026 · Tags: Cross-site scripting (XSS), CWE-791 - [Denial-of-Service via SVG Rendering in Ticket](https://agentprime.io/advisories/CVE-2026-48208.md) `CVE-2026-48208` · CVE record: OTRS AG OTRS and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Denial of service, CWE-791 - [Dromara lamp-cloud Message Template GroovyClassLoader.parseClass special elements used in a template engine](https://agentprime.io/advisories/CVE-2026-9498.md) `CVE-2026-9498` · CVE record: Dromara lamp-cloud · CVSS 5.3 Medium · Not analysed yet · Published 25 May 2026 · Tags: Code injection, CWE-791 - [Camel-CXF and Camel-Knative Message Header are Vulnerable to Injection via Missing Inbound Filtering](https://agentprime.io/advisories/GHSA-8364-hfqj-pwm6.md) `GHSA-8364-hfqj-pwm6`, `CVE-2026-47323` · Maven `org.apache.camel:camel-cxf-rest`: affected `>=3.18.0, <4.14.6 || >=4.15.0, <4.18.2`, fixed in `4.14.6`, `4.18.2` · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.20 · Not analysed yet · Published 19 May 2026 · Tags: CWE-178, CWE-791 - [Sanluan PublicCMS templateResult API TemplateResultDirective.java execute special elements used in a template engine](https://agentprime.io/advisories/CVE-2026-8740.md) `CVE-2026-8740` · CVE record: Sanluan PublicCMS · CVSS 5.3 Medium · Not analysed yet · Published 17 May 2026 · Tags: Code injection, CWE-791 - [dssrf: every IPv6 category bypasses is_url_safe](https://agentprime.io/advisories/GHSA-8p33-q827-ghj5.md) `GHSA-8p33-q827-ghj5`, `CVE-2026-44232` · npm `dssrf`: affected `<1.0.3`, fixed in `1.0.3` · CVSS 8.7 High · Not analysed yet · Published 6 May 2026 · Tags: CWE-791 - [pf can overflow the stack parsing crafted SCTP packets](https://agentprime.io/advisories/CVE-2026-7164.md) `CVE-2026-7164` · CVE record: FreeBSD FreeBSD · CVSS 7.5 High · Not analysed yet · Published 30 Apr 2026 · Tags: Denial of service, CWE-791 - [netfoil's optional seccomp sandboxing was not applied](https://agentprime.io/advisories/GHSA-vjgj-42f6-7997.md) `GHSA-vjgj-42f6-7997`, `GO-2026-5664` · Go `github.com/tinfoil-factory/netfoil`: affected `<0.2.1`, fixed in `0.2.1` · CVSS 4.0, no score published · Not analysed yet · Published 29 Apr 2026 · Tags: CWE-791 - [AstrBot has Incomplete Filtering of Special Elements](https://agentprime.io/advisories/GHSA-h3rr-9wqj-v3c6.md) `GHSA-h3rr-9wqj-v3c6`, `CVE-2026-6984`, `PYSEC-2026-2381` · PyPI `astrbot`: affected `<=4.22.1`, no fixed version yet · CVSS 5.1 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: Code injection, CWE-791 - [Sanluan PublicCMS FreeMarker Template AbstractFreemarkerView.java AbstractFreemarkerView.doRender special elements used in a template engine](https://agentprime.io/advisories/CVE-2026-5987.md) `CVE-2026-5987` · CVE record: Sanluan PublicCMS · CVSS 5.1 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: Code injection, CWE-791 - [PyBlade: SSTI/RCE via Bypassed AST Validation in sandbox.py](https://agentprime.io/advisories/GHSA-23jg-5f8m-gw8c.md) `GHSA-23jg-5f8m-gw8c`, `CVE-2026-5559`, `PYSEC-2026-2975` · PyPI `pyblade`: affected `>=0.1.8-alpha, <=0.2.0-alpha`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Code injection, CWE-791 - [1024-lab/lab1024 SmartAdmin FreeMarker Template MailService.java freemarkerResolverContent special elements used in a template engine](https://agentprime.io/advisories/CVE-2026-3725.md) `CVE-2026-3725` · CVE record: 1024-lab SmartAdmin and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 8 Mar 2026 · Tags: Code injection, CWE-791 - [OpenCart Incomplete Fix CVE-2024-36694 template.php save special elements used in a template engine](https://agentprime.io/advisories/CVE-2026-3714.md) `CVE-2026-3714` · CVE record: OpenCart · CVSS 5.1 Medium · Not analysed yet · Published 8 Mar 2026 · Tags: Code injection, CWE-791 - [TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution](https://agentprime.io/advisories/GHSA-928r-fm4v-mvrw.md) `GHSA-928r-fm4v-mvrw`, `CVE-2026-29186` · npm `@backstage/plugin-techdocs-node`: affected `<1.14.3`, fixed in `1.14.3` · CVSS 7.7 High · Not analysed yet · Published 5 Mar 2026 · Tags: Other injection, Unrestricted file upload, CWE-791 - [datapizza-ai: Server-Side Template Injection in ChatPromptTemplate via Jinja2 Template Handler](https://agentprime.io/advisories/GHSA-q5xx-fxv3-xxqf.md) `GHSA-q5xx-fxv3-xxqf`, `CVE-2026-2969`, `PYSEC-2026-2439` · PyPI `datapizza-ai-core`: affected `<=0.0.2`, no fixed version yet · CVSS 5.1 Medium · Not analysed yet · Published 23 Feb 2026 · Tags: Code injection, CWE-791 - [CTCMS Content Management System Frontend/Template Management CT_Parser.php special elements used in a template engine](https://agentprime.io/advisories/CVE-2025-14731.md) `CVE-2025-14731` · CVE record: CTCMS Content Management System · CVSS 5.3 Medium · Not analysed yet · Published 15 Dec 2025 · Tags: Code injection, CWE-791 - [HAProxy Kubernetes Ingress Controller: HAProxy Kubernetes Ingress Controller before 3.1.13…](https://agentprime.io/advisories/CVE-2025-59303.md) `CVE-2025-59303` · CVE record: HAProxy HAProxy Kubernetes Ingress Controller · CVSS 6.4 Medium · Not analysed yet · Published 8 Oct 2025 · Tags: CWE-791 - [ThingsBoard Add Gateway special elements used in a template engine](https://agentprime.io/advisories/CVE-2025-9094.md) `CVE-2025-9094` · CVE record: ThingsBoard · CVSS 5.3 Medium · Not analysed yet · Published 17 Aug 2025 · Tags: Code injection, CWE-791 - [Kingdee Cloud-Starry-Sky Enterprise Edition Freemarker Engine DynamicForm 4 Action.class plugin.buildMobilePopHtml special elements used in a template engine](https://agentprime.io/advisories/CVE-2025-6761.md) `CVE-2025-6761` · CVE record: Kingdee Cloud-Starry-Sky Enterprise Edition · CVSS 6.9 Medium · Not analysed yet · Published 27 Jun 2025 · Tags: Code injection, CWE-791 - [pyspur Incomplete Filtering of Special Elements allowed by SingleLLMCallNode function](https://agentprime.io/advisories/GHSA-8gff-cf92-72pv.md) `GHSA-8gff-cf92-72pv`, `CVE-2025-6518`, `PYSEC-2026-1844` · PyPI `pyspur`: affected `<=0.1.18`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 23 Jun 2025 · Tags: Code injection, CWE-791 - [AngularJS Incomplete Filtering of Special Elements vulnerability](https://agentprime.io/advisories/GHSA-4p4w-6hg8-63wx.md) `GHSA-4p4w-6hg8-63wx`, `CVE-2025-2336` · npm `angular-sanitize`: affected `>=1.3.1, <=1.8.3`, no fixed version yet · CVSS 4.8 Medium · Not analysed yet · Published 4 Jun 2025 · Tags: CWE-791 - [The VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges.](https://agentprime.io/advisories/CVE-2025-0324.md) `CVE-2025-0324` · CVE record: Axis Communications AB AXIS OS · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Jun 2025 · Tags: CWE-791 - [zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 testService special elements used in a template engine](https://agentprime.io/advisories/CVE-2025-5325.md) `CVE-2025-5325` · CVE record: zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 · CVSS 5.3 Medium · Not analysed yet · Published 29 May 2025 · Tags: Code injection, CWE-791 - [AngularJS improperly sanitizes SVG elements](https://agentprime.io/advisories/GHSA-j58c-ww9w-pwp5.md) `GHSA-j58c-ww9w-pwp5`, `CVE-2025-0716` · npm `angular`: affected `<=1.8.3`, no fixed version yet · CVSS 4.8 Medium · Not analysed yet · Published 29 Apr 2025 · Tags: CWE-791 - [wix-incubator jam Jinja2 Template jam.py special elements used in a template engine](https://agentprime.io/advisories/CVE-2025-3841.md) `CVE-2025-3841` · CVE record: wix-incubator jam · CVSS 4.8 Medium · Not analysed yet · Published 21 Apr 2025 · Tags: Code injection, CWE-791 - [Improper authentication in SSH of B&R APROL](https://agentprime.io/advisories/CVE-2024-45481.md) `CVE-2024-45481` · CVE record: B&R Industrial Automation B&R APROL · CVSS 8.5 High · Not analysed yet · Published 25 Mar 2025 · Tags: CWE-791 - [zhijiantianya ruoyi-vue-pro deploy special elements used in a template engine](https://agentprime.io/advisories/CVE-2025-2040.md) `CVE-2025-2040` · CVE record: zhijiantianya ruoyi-vue-pro · CVSS 5.3 Medium · Not analysed yet · Published 6 Mar 2025 · Tags: Code injection, CWE-791 - [Cross-Site Scripting (XSS) vulnerability in SAP Web Dispatcher](https://agentprime.io/advisories/CVE-2024-47590.md) `CVE-2024-47590` · CVE record: SAP_SE SAP Web Dispatcher · CVSS 8.8 High · Not analysed yet · Published 12 Nov 2024 · Tags: CWE-791 - [AngularJS allows attackers to bypass common image source restrictions](https://agentprime.io/advisories/GHSA-mqm9-c95h-x2p6.md) `GHSA-mqm9-c95h-x2p6`, `CVE-2024-8373` · npm `angular`: affected `<=1.8.3`, no fixed version yet · CVSS 4.8 Medium · Not analysed yet · Published 9 Sept 2024 · Tags: CWE-791 - [Intel(R) TDX module software: Incomplete filtering of special elements in Intel(R) TDX module software before version…](https://agentprime.io/advisories/CVE-2024-39283.md) `CVE-2024-39283` · CVE record: Intel(R) TDX module software · CVSS 8.5 High · Not analysed yet · Published 14 Aug 2024 · Tags: CWE-791 - [An issue in the DelFile() function of WMCMS v4.4 allows attackers to delete arbitrary files via a crafted POST request.](https://agentprime.io/advisories/CVE-2024-27489.md) `CVE-2024-27489` · CVE record · CVSS 7.5 High · Not analysed yet · Published 19 Jul 2024 · Tags: CWE-473, CWE-791 - [PrivateBin allows shortening of URLs for other domains](https://agentprime.io/advisories/GHSA-mqqj-fx8h-437j.md) `GHSA-mqqj-fx8h-437j`, `CVE-2024-39899`, `PKSA-fj49-qny2-dzp5` · Packagist `privatebin/privatebin`: affected `>=1.5.0, <1.7.4`, fixed in `1.7.4` · CVSS 5.3 Medium · Not analysed yet · Published 10 Jul 2024 · Tags: CWE-305, CWE-791 - [CMSeasy 7.7.7.9 is vulnerable to Arbitrary file deletion.](https://agentprime.io/advisories/CVE-2024-32162.md) `CVE-2024-32162` · CVE record · CVSS 4.3 Medium · Not analysed yet · Published 17 Apr 2024 · Tags: CWE-791 - [The XAO::Web module before 1.84 for Perl mishandles < and > characters in JSON output during use of json-embed in Web::Action.](https://agentprime.io/advisories/CVE-2020-36827.md) `CVE-2020-36827` · CVE record · CVSS 5.4 Medium · Not analysed yet · Published 24 Mar 2024 · Tags: CWE-791 - [Incomplete Filtering of Special Elements](https://agentprime.io/advisories/CVE-2023-31172.md) `CVE-2023-31172` · CVE record: Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software · CVSS 5.9 Medium · Not analysed yet · Published 31 Aug 2023 · Tags: CWE-791 - [A flaw was found in the Linux Kernel.](https://agentprime.io/advisories/CVE-2023-1076.md) `CVE-2023-1076` · CVE record: Linux kernel · CVSS 5.5 Medium · Not analysed yet · Published 27 Mar 2023 · Tags: CWE-791 - [A permissive list of allowed inputs flaw was found in DPDK.](https://agentprime.io/advisories/CVE-2022-2132.md) `CVE-2022-2132` · CVE record: dpdk · No CVSS score · Not analysed yet · Published 31 Aug 2022 · Tags: CWE-791 - [Pipenv's requirements.txt parsing allows malicious index url in comments](https://agentprime.io/advisories/GHSA-qc9x-gjcv-465w.md) `GHSA-qc9x-gjcv-465w`, `CVE-2022-21668`, `PYSEC-2022-6` · PyPI `pipenv`: affected `>=2018.10.9, <2022.1.8`, fixed in `2022.1.8` · CVSS 8.0 High · Not analysed yet · Published 12 Jan 2022 · Tags: Command injection, CWE-20, CWE-427, CWE-791 ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .