Latest high and critical flaws
- CVE-2026-74795 Scriban before 6.6.0 contains an uncontrolled recursion vulnerability in its recursive-descent parser.High 8.7 · Aug 16, 2026
- CVE-2026-74794 Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit property defaults to unlimited.High 8.7 · Aug 16, 2026
- CVE-2026-74792 Scriban before 7.0.0 (affected versions <= 6.6.0) contains a stack overflow vulnerability in nested array initializer parsing.High 8.7 · Aug 16, 2026
- CVE-2026-74791 Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset() is called, allowing cached templates to persist across reused coCritical 9.2 · Aug 16, 2026
- CVE-2026-74790 Scriban before 7.0.0 caches TypedObjectAccessor by Type only without considering MemberFilter changes, allowing reused TemplateContext instances to expose membeCritical 9.3 · Aug 16, 2026
- CVE-2026-74789 Scriban before 7.0.0 (affected <= 6.6.0) applies its LoopLimit constraint only to script loop statements and not to expensive iteration performed inside built-iHigh 8.7 · Aug 16, 2026
- CVE-2026-74788 Scriban before 7.0.0 (affected versions <= 6.6.0) contains an uncontrolled memory allocation vulnerability in the string.pad_left and string.pad_right template High 8.7 · Aug 16, 2026
- CVE-2026-74787 Scriban before 7.0.0 contains an uncontrolled recursion vulnerability in the object.to_json builtin function that lacks depth limits and circular reference deteHigh 8.7 · Aug 16, 2026
- CVE-2026-74786 Scriban before 7.0.0 (affected versions <= 6.6.0) contains a denial-of-service vulnerability in which the LimitToString safety limit (default 1MB) can be bypassHigh 7.1 · Aug 16, 2026
- CVE-2026-74785 Scriban before 7.0.0 contains three distinct denial-of-service vulnerabilities in expression evaluation that bypass existing safety controls through unbounded sHigh 7.1 · Aug 16, 2026
- CVE-2026-74784 Scriban before 7.2.0 contains a denial of service vulnerability in the array.insert_at function that allocates unbounded null entries without respecting LoopLimHigh 8.7 · Aug 16, 2026
- CVE-2026-74783 Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressionHigh 8.7 · Aug 16, 2026
- CVE-2026-73062 Scriban versions 3.0.0 through 7.2.0 contain a denial of service vulnerability in the array multiplication operator that allocates memory without enforcing LoopHigh 8.7 · Aug 16, 2026
- CVE-2026-73061 Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that allows template code to write CLR object properties without seCritical 9.3 · Aug 16, 2026
- CVE-2026-73060 Scriban versions from 3.0.0 through 7.2.5 contain a denial of service vulnerability in the ScriptRange.Multiply operator that bypasses LoopLimit when the left oHigh 8.7 · Aug 16, 2026
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.