smarty has 3 CVEs on record. 3 were published in the last 90 days. The busiest recent month was August 2026 with 3. The median CVSS is 8.6 (high).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.6
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Worst active — by depth score
CVE-2026-62993Medium· 8.6Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic47CVE-2026-62996MediumSmarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic28CVE-2026-62992MediumSmarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic28
smarty vulnerabilities
CVEs affecting smarty, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-62993Medium· 8.6Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 4.5.7 and 5.8.2, depending on the release line, Smarty's {fetch} handling in libs/plugins/function.fetch.php and…
CVE-2026-62992MediumSmarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 5.8.2 (and 4.5.7 on the 4.x line), Security::_checkDir() does not fully resolve symbolic links before validating…
CVE-2026-62996MediumSmarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. From 5.0.0 until 5.8.4, Smarty's stream: resource-name handling does not adequately restrict which PHP stream wrappers an…