Vulnerabilities
Summary — last 7 days
New vulnerabilities2,811▲ 64 vs. last week
Critical / high1,484▲ 296 vs. last week
New active exploitation (KEV)5▼ 5 vs. last week
Unscored (no CVSS)68▼ 448 vs. last week
3 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | High (7.5) | 0.69% | — | Handlebars.javaAI | 9/30/2026 | 9/30/2026 | Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment fix for CVE-2026-63490 validates template locations as raw percent-encoded strings, whereas the template file is opened through a URL handler that percent-decodes the path. In a Spring MVC application… | |
| Deferred | High (7.5) | 0.69% | — | Jknack Handlebars.javaAIJknack Handlebars-springmvcAI | 8/20/2026 | 9/18/2026 | Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment validation used by other URL-based loaders. In… | |
| Awaiting Analysis | High (7.5) | 0.53% | — | Handlebars.javaAI | 7/8/2026 | 7/10/2026 | Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.2, applications that pass user-controlled input to Handlebars.compile() using FileTemplateLoader or ClassPathTemplateLoader are vulnerable to path traversal, allowing arbitrary file read through template names derived from URL… |