Misconfiguration and Insecure Design

Every one of the 6 is a mark on the map. Named now: 1 to 6, most at risk first.

1. Twig has a possible sandbox bypassCVE-2024-45411twigphp · CVSS 8.6 · 0.8% likely

   CWE-693

2. Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterfaceCVE-2026-24425twigphp · CVSS 8.8 · 0.8% likely

   CWE-693

3. Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template nameCVE-2026-46634twigphp · CVSS 7.7 · 0.6% likely

   CWE-693

4. Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`CVE-2026-48805twigphp · CVSS 5.3 · 0.5% likely

   CWE-693

5. Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)CVE-2026-46638twigphp · CVSS 6 · 0.5% likely

   CWE-693

6. Twig: Sandbox property and method bypass via object-destructuring assignmentCVE-2026-46639twigphp · CVSS 7.1 · 0.4% likely

   CWE-693

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.