Vulnerability database

7 results

• Sep 8, 2026Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine VulnerabilityCVE-2026-75650 · Websites & servers · Adobe · reported by AdobeExploitedCritical 10

  Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code.

  Product

  Commerce and Magento

  On CISA’s list since

  Sep 8, 2026 (federal fix deadline Sep 11, 2026)

  What to do

  Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA cataloghelpx.adobe.comcisa.gov

• Jul 9, 2024Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine VulnerabilityCVE-2024-23692 · Other software · Rejetto · reported by VulnCheckExploitedRansomwareCritical 9.8

  Rejetto HTTP File Server contains an improper neutralization of special elements used in a template engine vulnerability. This allows a remote, unauthenticated attacker to execute commands on the affected system by sending a specially crafted HTTP request.

  Product

  HTTP File Server

  On CISA’s list since

  Jul 9, 2024 (federal fix deadline Jul 30, 2024)

  What to do

  Attackers are using this now. Install Rejetto’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA cataloggithub.commohemiv.com

• Jan 24, 2024Atlassian Confluence Data Center and Server Template Injection VulnerabilityCVE-2023-22527 · Websites & servers · Atlassian · reported by security@atlassian.comExploitedRansomwareCritical 9.8

  Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution.

  Product

  Confluence Data Center and Server

  On CISA’s list since

  Jan 24, 2024 (federal fix deadline Feb 14, 2024)

  What to do

  Attackers are using this now. Install Atlassian’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comconfluence.atlassian.com

• Apr 14, 2022VMware Workspace ONE Access and Identity Manager Server-Side Template Injection VulnerabilityCVE-2022-22954 · Other software · VMware · reported by security@vmware.comExploitedRansomwareCritical 9.8

  VMware Workspace ONE Access and Identity Manager allow for remote code execution due to server-side template injection.

  Product

  Workspace ONE Access and Identity Manager

  On CISA’s list since

  Apr 14, 2022 (federal fix deadline May 5, 2022)

  What to do

  Attackers are using this now. Install VMware’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comvmware.com

• Mar 7, 2022Atlassian Jira Server and Data Center Server-Side Template Injection VulnerabilityCVE-2019-11581 · Websites & servers · Atlassian · reported by security@atlassian.comExploitedCritical 9.8

  Atlassian Jira Server and Data Center contain a server-side template injection vulnerability which can allow for remote code execution.

  Product

  Jira Server and Data Center

  On CISA’s list since

  Mar 7, 2022 (federal fix deadline Sep 7, 2022)

  What to do

  Attackers are using this now. Install Atlassian’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogjira.atlassian.comjira.atlassian.com

• Nov 3, 2021Atlassian Confluence Server and Data Center Server-Side Template Injection VulnerabilityCVE-2019-3396 · Websites & servers · Atlassian · reported by security@atlassian.comExploitedRansomwareCritical 9.8

  Atlassian Confluence Server and Data Center contain a server-side template injection vulnerability that may allow an attacker to achieve path traversal and remote code execution.

  Product

  Confluence Server and Data Server

  On CISA’s list since

  Nov 3, 2021 (federal fix deadline May 3, 2022)

  What to do

  Attackers are using this now. Install Atlassian’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogpacketstormsecurity.compacketstormsecurity.com

• Nov 3, 2021PlaySMS Server-Side Template Injection VulnerabilityCVE-2020-8644 · Other software · PlaySMS · reported by MITREExploitedCritical 9.8

  PlaySMS contains a server-side template injection vulnerability that allows for remote code execution.

  Product

  PlaySMS

  On CISA’s list since

  Nov 3, 2021 (federal fix deadline May 3, 2022)

  What to do

  Attackers are using this now. Install PlaySMS’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comforum.playsms.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.