Question 1

What is CVE-2026-46628 — CVE-2026-46628?

Accepted Answer

Twig is a template language for PHP. Prior to 3.26.0, the deprecated spaceless filter is registered as safe for HTML, causing Twig autoescaping to emit attacker-controlled markup unescaped when spaceless is applied to untrusted input. This issue is fixed in version 3.26.0.

Question 2

What is the authoritative source for CVE-2026-46628?

Accepted Answer

CVE-2026-46628 (CVE-2026-46628) is catalogued in NVD + CISA KEV + FIRST EPSS and curated for EU compliance use cases by SQUR.

CVE-2026-46628CVE-2026-46628

Description

Scoring