CVE-2026-74791

The record

Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset() is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earlier renders without triggering TemplateLoader.Load() again.

Affected packages

Related vulnerabilities

• CVE-2026-107315 pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is… CWE-226
• CVE-2026-74250 In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run… CWE-226
• CVE-2026-48984 pam_usb provides hardware authentication for Linux using ordinary removable media. CWE-226
• CVE-2026-32960 SD-330AC and AMC Manager provided by silex technology, Inc. CWE-226
• CVE-2026-5795 In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which… CWE-226
• CVE-2025-14858 The Semtech LR11xx LoRa transceivers running early versions of firmware contains an… CWE-226
• CVE-2019-25657 AnyBurn 4.3 x86 contains a denial of service vulnerability that allows local attackers to… CWE-226
• GHSA-9p93-7j67-5pc2 OpenClaw: Gateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill Path Without Caller… CWE-226