CWE-1336

CVEs per yearBy the year they were published

1. 20211
2. 20226
3. 202312
4. 202427
5. 202557
6. 2026194

Known exploitedNewest addition to KEV first

• CVE-2026-75650

  Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

  Adobe · Adobe Commerce

  ExploitedCritical10.0
• CVE-2024-23692

  Rejetto HTTP File Server 2.3m Unauthenticated RCE

  Rejetto · HTTP File Server

  ExploitedCritical9.8
• CVE-2024-4040

  Unauthenticated arbitrary file read and remote code execution in CrushFTP

  CrushFTP · CrushFTP

  ExploitedCritical9.8

Newest CVEs

• CVE-2026-57853

  DataGerry < 3.3.0 SSTI via DocAPI Template Rendering

  DataGerry · DataGerry

  High8.7
• CVE-2026-92196

  Quest Foglight for Databases renderTemplateString Server-Side Template Injection Remote Code Execution Vulnerability

  Quest · Foglight for Databases

  High7.2
• CVE-2026-39379

  GeoNetwork: Reflected XSS through client-side template injection

  geonetwork · core-geonetwork

  High7.1
• CVE-2026-44267

  Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitter

  enspirit · elo

  Critical9.8
• CVE-2026-44266

  Elo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels

  enspirit · elo

  Critical9.8
• CVE-2026-119085

  Template injection in the publishing component of awslabs Virtual Engineering Workbench

  AWS · virtual-engineering-workbench

  Critical9.4
• CVE-2026-107259

  Linked Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-200

  Drupal · Linked Field

  Medium5.4
• CVE-2026-107264

  Inline Formatter Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-203

  Drupal · Inline Formatter Field

  Medium5.4
• CVE-2026-61707

  SOCFortress CoPilot: Stored case-report template injection permits backend code execution

  socfortress · CoPilot

  Critical9.0
• CVE-2026-119144

  Frappe Framework before 15.111.0 and 16.x before 16.21.0 Server-Side Template Injection via Message Fields

  frappe · frappe

  High8.7

Vendors it comes up for most

1. craftcms13
2. getgrav11
3. orval-labs7
4. Apache Software Foundation6
5. frappe6
6. Adobe4
7. Drupal4
8. acacode4
9. bagisto4
10. Dell3