Known vulnerabilities in Twig

Vendor: Symfony
Software: Twig
Software CPE: cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:*
Total vulnerabilities: 20
Public exploits: 1
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Twig Twig is affected by 20 known vulnerabilities: 4 high, 9 medium, 7 low Critical High Medium Low

Vulnerabilities (20)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU132002 - Protection Mechanism Failure
CVE-2026-24425
CWE-693 Medium
No
No
3.26.0 20.05.2026 SB2026052091
SB2026060937
#VU132001 - Improper Encoding or Escaping of Output
CVE-2026-46628
CWE-116 Medium
No
No
3.26.0 20.05.2026 SB2026052091
SB2026060335
#VU132000 - Protection Mechanism Failure
CVE-2026-46639
CWE-693 Low
No
No
3.26.0 20.05.2026 SB2026052091
#VU131999 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-46633
CWE-94 High
No
No
3.26.0 20.05.2026 SB2026052091
SB2026060335
#VU131998 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-46640
CWE-94 Medium
No
No
3.26.0 20.05.2026 SB2026052091
#VU131997 - Incorrect Authorization
CVE-2026-46635
CWE-863 Low
No
No
3.26.0 20.05.2026 SB2026052091
#VU131996 - Protection Mechanism Failure
CVE-2026-46634
CWE-693 High
No
No
3.26.0 20.05.2026 SB2026052091
#VU131995 - Protection Mechanism Failure
CVE-2026-46638
CWE-693 Low
No
No
3.26.0 20.05.2026 SB2026052091
#VU131994 - Allocation of Resources Without Limits or Throttling
CVE-2026-46629
CWE-770 Medium
No
No
3.26.0 20.05.2026 SB2026052091
SB2026060335
#VU131993 - Improper Encoding or Escaping of Output
CVE-2026-46637
CWE-116 Medium
No
No
3.26.0 20.05.2026 SB2026052091
SB2026060335
#VU131992 - Resource exhaustion
CVE-2026-46627
CWE-400 Medium
No
No
3.26.0 20.05.2026 SB2026052091
#VU131991 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-47730
CWE-79 Medium
No
No
3.26.0 20.05.2026 SB2026052091
SB2026060335
#VU131990 - Improper Access Control
CVE-2026-47732
CWE-284 Low
No
No
3.26.0 20.05.2026 SB2026052091
#VU131989 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-24374
CWE-79 Medium
No
No
3.19.0 29.01.2025 SB2025012966
#VU102072 - Protection Mechanism Failure
CVE-2024-45411
CWE-693 High
No
No
1.44.8, 2.16.1, 3.14.0 30.12.2024 SB2024123097
SB20241230139
SB2025021858
and 1 more
#VU131988 - Improper Access Control
CVE-2024-51755
CWE-284 Low
No
No
3.11.2, 3.14.1 06.11.2024 SB2024110669
#VU131987 - Improper Access Control
CVE-2024-51754
CWE-284 Low
No
No
3.11.2, 3.14.1 06.11.2024 SB2024110669
SB2026060335
#VU73271 - Exposure of sensitive information to an unauthorized actor
CVE-2019-9942
CWE-200 Low
No
No
1.38.0, 2.7.0 13.03.2023 SB2019032314
SB2023031401
#VU67723 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2022-39261
CWE-22 Medium
No
No
1.44.7, 2.15.3, 3.4.3 28.09.2022 SB2022092839
SB2022092840
SB2022100546
and 7 more
#VU61609 - Security Features
CVE-2022-23614
CWE-254 High
Available
No
2.14.11, 3.3.8 24.03.2022 SB2022032424
SB2022032425
SB2023031401
and 4 more