CVE-2026-85654High· 7.8▾ TwilightImproper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might allow a context-dependent actor to execute arbitrary code on the host that deploys the ge…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.1%
0.1% → 0.2%
Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might allow a context-dependent actor to execute arbitrary code on the host that deploys the generated application via crafted table, index, or attribute names in a data model file.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-27641Critical· 9.8Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection
CVE-2026-115189High· 8.8A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic
CVE-2026-115938High· 8.8Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE
CVE-2026-55486Critical· 9.3Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS
CVE-2026-96392Low· 3.5AI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-187
CVE-2026-96355Critical· 9.1Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175