[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-33154":6},{"stargazers_count":4,"fetched_at":5},7,"2026-08-01T00:21:03.480Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":95,"aliases":105,"duplicate_of":9,"upstream":108,"downstream":109,"duplicates":122,"related":123,"reserved_at":9,"published_at":128,"modified_at":129,"state":130,"summary":131,"references_raw":139,"kevs":172,"epss":173,"epss_history":176,"metrics":447,"affected":460},"CVE-2026-33154","dynaconf is a configuration management tool for Python. Prior to version 3.2.13, Dynaconf is vulnerable to Server-Side Template Injection (SSTI) due to unsafe template evaluation in the @Jinja resolver. When the jinja2 package is installed, Dynaconf evaluates template expressions embedded in configuration values without a sandboxed environment. This issue has been patched in version 3.2.13.",null,[11,62,68],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-94","Improper Control of Generation of Code ('Code Injection')","The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.","weakness","Draft","Base","Medium",[20,24,58],{"id":21,"name":22,"techniques":23},"CAPEC-242","Code Injection",[],{"id":25,"name":26,"techniques":27},"CAPEC-35","Leverage Executable Code in Non-Executable Files",[28,39,46],{"id":29,"name":30,"tactics":31,"countermeasures":38},"T1027.006","HTML Smuggling",[32,35],{"id":33,"name":34},"TA0030","Defense Evasion",{"id":36,"name":37},"TA0005","Stealth",[],{"id":40,"name":41,"tactics":42,"countermeasures":45},"T1027.009","Embedded Payloads",[43,44],{"id":33,"name":34},{"id":36,"name":37},[],{"id":47,"name":48,"tactics":49,"countermeasures":52},"T1564.009","Resource Forking",[50,51],{"id":33,"name":34},{"id":36,"name":37},[53],{"id":54,"name":55,"tactic":56},"D3-FFV","File Format Verification",{"name":57},"Isolate",{"id":59,"name":60,"techniques":61},"CAPEC-77","Manipulating User-Controlled Variables",[],{"_key":63,"id":63,"name":64,"description":65,"type":15,"status":66,"abstraction":17,"likelihood_of_exploit":9,"capec":67},"CWE-1336","Improper Neutralization of Special Elements Used in a Template Engine","The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.","Incomplete",[],{"_key":69,"id":69,"name":70,"description":71,"type":15,"status":72,"abstraction":17,"likelihood_of_exploit":73,"capec":74},"CWE-78","Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.","Stable","High",[75,79,83,87,91],{"id":76,"name":77,"techniques":78},"CAPEC-108","Command Line Execution through SQL Injection",[],{"id":80,"name":81,"techniques":82},"CAPEC-15","Command Delimiters",[],{"id":84,"name":85,"techniques":86},"CAPEC-43","Exploiting Multiple Input Interpretation Layers",[],{"id":88,"name":89,"techniques":90},"CAPEC-6","Argument Injection",[],{"id":92,"name":93,"techniques":94},"CAPEC-88","OS Command Injection",[],[96],{"_key":97,"name":98,"source":99,"url":100,"maturity":101,"reliability_score":102,"verified":103,"type":9,"platforms":104,"requires_auth":9,"exploitdb":9,"metasploit":9},"GITHUB_DYNACONF_DYNACONF","Dynaconf","github","https://github.com/dynaconf/dynaconf/security/advisories/GHSA-pxrr-hq57-q35p","poc",0.3,false,[],[106,107],"GHSA-pxrr-hq57-q35p","PYSEC-2026-2147",[],[110,112,114,116,118,120],{"_key":111},"OPENSUSE-SU-2026:10411-1",{"_key":113},"OPENSUSE-SU-2026:20429-1",{"_key":115},"UBUNTU-CVE-2026-33154",{"_key":117},"USN-8231-1",{"_key":119},"RHSA-2026:34160",{"_key":121},"DEBIAN-CVE-2026-33154",[],[124,125,126],{"_key":111},{"_key":113},{"_key":127},"CGA-JHQX-7VG2-54HH","2026-03-20T20:22:59.090Z","2026-03-27T15:23:09.972Z","Analyzed",{"cisa_kev":103,"cisa_ransomware":103,"cisa_vendor":9,"epss_severity":132,"epss_score":133,"severity":134,"severity_score":135,"severity_version":136,"severity_source":137,"severity_vector":138,"severity_status":130},"low",0.00526,"high",8.1,"v3.1","nvd","CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",[140,150,155,162,168],{"url":100,"sources":141,"tags":144},[142,143,137],"osv_pypi","cve.org",[145,146,147,148,149],"WEB","X Refsource CONFIRM","Exploit","Vendor Advisory","EVIDENCE",{"url":151,"sources":152,"tags":153},"https://github.com/dynaconf/dynaconf",[142],[154],"PACKAGE",{"url":156,"sources":157,"tags":158},"https://github.com/dynaconf/dynaconf/commit/2fbb45ee36b8c0caa5b924fe19f3c1a5e8603fa7",[143,137,142],[159,145,160,161],"X Refsource MISC","Patch","FIX",{"url":163,"sources":164,"tags":165},"https://github.com/dynaconf/dynaconf/releases/tag/3.2.13",[143,137,142],[159,145,166,167],"Release Notes","Advisory",{"url":169,"sources":170,"tags":171},"https://nvd.nist.gov/vuln/detail/CVE-2026-33154",[142],[167],[],{"date":174,"score":133,"percentile":175},"2026-07-05",0.40726,[177,181,184,187,190,192,196,199,202,204,207,210,213,216,219,222,225,228,231,234,237,240,243,246,249,252,256,259,262,265,268,271,275,278,281,284,287,290,293,296,299,302,305,308,311,314,317,319,322,325,328,331,334,337,340,342,345,348,351,354,357,360,363,366,369,372,375,378,382,385,388,391,394,397,400,403,406,409,412,415,418,420,423,426,429,432,435,438,441,444],{"date":178,"score":179,"percentile":180},"2026-03-21",0.00045,0.13643,{"date":182,"score":179,"percentile":183},"2026-03-22",0.13623,{"date":185,"score":179,"percentile":186},"2026-03-23",0.1355,{"date":188,"score":179,"percentile":189},"2026-03-24",0.13553,{"date":191,"score":179,"percentile":180},"2026-03-25",{"date":193,"score":194,"percentile":195},"2026-03-26",0.0005,0.15603,{"date":197,"score":194,"percentile":198},"2026-03-27",0.15578,{"date":200,"score":194,"percentile":201},"2026-03-28",0.15615,{"date":203,"score":194,"percentile":198},"2026-03-29",{"date":205,"score":194,"percentile":206},"2026-03-30",0.15542,{"date":208,"score":194,"percentile":209},"2026-03-31",0.15518,{"date":211,"score":194,"percentile":212},"2026-04-01",0.15549,{"date":214,"score":194,"percentile":215},"2026-04-02",0.15592,{"date":217,"score":194,"percentile":218},"2026-04-03",0.1562,{"date":220,"score":194,"percentile":221},"2026-04-04",0.1566,{"date":223,"score":194,"percentile":224},"2026-04-05",0.1564,{"date":226,"score":194,"percentile":227},"2026-04-06",0.15476,{"date":229,"score":194,"percentile":230},"2026-04-07",0.15459,{"date":232,"score":194,"percentile":233},"2026-04-08",0.15546,{"date":235,"score":194,"percentile":236},"2026-04-09",0.15602,{"date":238,"score":194,"percentile":239},"2026-04-10",0.15607,{"date":241,"score":194,"percentile":242},"2026-04-11",0.15566,{"date":244,"score":194,"percentile":245},"2026-04-12",0.15528,{"date":247,"score":194,"percentile":248},"2026-04-13",0.15464,{"date":250,"score":194,"percentile":251},"2026-04-14",0.15368,{"date":253,"score":254,"percentile":255},"2026-04-15",0.00052,0.16184,{"date":257,"score":254,"percentile":258},"2026-04-16",0.16169,{"date":260,"score":254,"percentile":261},"2026-04-17",0.16177,{"date":263,"score":254,"percentile":264},"2026-04-18",0.16186,{"date":266,"score":254,"percentile":267},"2026-04-19",0.16128,{"date":269,"score":254,"percentile":270},"2026-04-20",0.16121,{"date":272,"score":273,"percentile":274},"2026-04-21",0.00021,0.05736,{"date":276,"score":273,"percentile":277},"2026-04-22",0.05747,{"date":279,"score":273,"percentile":280},"2026-04-23",0.0577,{"date":282,"score":273,"percentile":283},"2026-04-24",0.05768,{"date":285,"score":273,"percentile":286},"2026-04-25",0.05809,{"date":288,"score":273,"percentile":289},"2026-04-26",0.05804,{"date":291,"score":273,"percentile":292},"2026-04-27",0.05795,{"date":294,"score":273,"percentile":295},"2026-04-28",0.05794,{"date":297,"score":273,"percentile":298},"2026-04-29",0.05812,{"date":300,"score":273,"percentile":301},"2026-04-30",0.05818,{"date":303,"score":273,"percentile":304},"2026-05-01",0.05817,{"date":306,"score":273,"percentile":307},"2026-05-02",0.05839,{"date":309,"score":273,"percentile":310},"2026-05-03",0.05838,{"date":312,"score":273,"percentile":313},"2026-05-04",0.05826,{"date":315,"score":273,"percentile":316},"2026-05-05",0.05824,{"date":318,"score":273,"percentile":307},"2026-05-06",{"date":320,"score":273,"percentile":321},"2026-05-07",0.05904,{"date":323,"score":273,"percentile":324},"2026-05-08",0.05926,{"date":326,"score":273,"percentile":327},"2026-05-09",0.05968,{"date":329,"score":273,"percentile":330},"2026-05-10",0.05985,{"date":332,"score":273,"percentile":333},"2026-05-11",0.05981,{"date":335,"score":273,"percentile":336},"2026-05-12",0.05986,{"date":338,"score":273,"percentile":339},"2026-05-13",0.05996,{"date":341,"score":273,"percentile":336},"2026-05-14",{"date":343,"score":273,"percentile":344},"2026-05-15",0.05998,{"date":346,"score":273,"percentile":347},"2026-05-16",0.06007,{"date":349,"score":273,"percentile":350},"2026-05-17",0.06003,{"date":352,"score":273,"percentile":353},"2026-05-18",0.05971,{"date":355,"score":273,"percentile":356},"2026-05-19",0.05956,{"date":358,"score":273,"percentile":359},"2026-05-20",0.05924,{"date":361,"score":273,"percentile":362},"2026-05-21",0.05916,{"date":364,"score":273,"percentile":365},"2026-05-22",0.0613,{"date":367,"score":273,"percentile":368},"2026-05-23",0.06122,{"date":370,"score":273,"percentile":371},"2026-05-24",0.0612,{"date":373,"score":273,"percentile":374},"2026-05-25",0.06102,{"date":376,"score":273,"percentile":377},"2026-05-26",0.06081,{"date":379,"score":380,"percentile":381},"2026-05-27",0.00024,0.07136,{"date":383,"score":380,"percentile":384},"2026-05-28",0.07259,{"date":386,"score":380,"percentile":387},"2026-05-29",0.07267,{"date":389,"score":380,"percentile":390},"2026-05-30",0.07256,{"date":392,"score":380,"percentile":393},"2026-05-31",0.07244,{"date":395,"score":380,"percentile":396},"2026-06-01",0.07204,{"date":398,"score":380,"percentile":399},"2026-06-02",0.07151,{"date":401,"score":380,"percentile":402},"2026-06-03",0.07113,{"date":404,"score":380,"percentile":405},"2026-06-04",0.07122,{"date":407,"score":380,"percentile":408},"2026-06-05",0.07154,{"date":410,"score":380,"percentile":411},"2026-06-06",0.0716,{"date":413,"score":380,"percentile":414},"2026-06-07",0.07146,{"date":416,"score":380,"percentile":417},"2026-06-08",0.07101,{"date":419,"score":380,"percentile":405},"2026-06-09",{"date":421,"score":380,"percentile":422},"2026-06-10",0.07152,{"date":424,"score":380,"percentile":425},"2026-06-11",0.07173,{"date":427,"score":380,"percentile":428},"2026-06-12",0.07208,{"date":430,"score":380,"percentile":431},"2026-06-13",0.07203,{"date":433,"score":380,"percentile":434},"2026-06-14",0.07201,{"date":436,"score":133,"percentile":437},"2026-06-15",0.40166,{"date":439,"score":133,"percentile":440},"2026-06-16",0.40222,{"date":442,"score":133,"percentile":443},"2026-06-17",0.403,{"date":445,"score":133,"percentile":446},"2026-06-18",0.40346,[448,452,458],{"source":142,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":449,"cvss_v4_0":9},{"baseScore":135,"baseSeverity":9,"vectorString":138,"impactScore":450,"exploitabilityScore":451},9.8,5.6,{"source":143,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":453,"cvss_v4_0":9},{"baseScore":454,"baseSeverity":455,"vectorString":456,"impactScore":450,"exploitabilityScore":457},7.5,"HIGH","CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",4.1,{"source":137,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":459,"cvss_v4_0":9},{"baseScore":135,"baseSeverity":455,"vectorString":138,"impactScore":450,"exploitabilityScore":451},[461,471],{"ecosystem":9,"name":462,"vendor":462,"product":462,"cpe_part":463,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":464},"dynaconf","a",[465],{"version":466,"is_range":467,"range_type":468,"version_start":9,"version_start_type":9,"version_end":469,"version_end_type":470,"fixed_in":9},"lt3.2.13",true,"cpe","3.2.13","excluding",{"ecosystem":472,"name":462,"vendor":472,"product":462,"cpe_part":9,"purl_type":473,"purl_namespace":9,"purl_name":462,"source":9,"versions":474},"PyPI","pypi",[475],{"version":476,"is_range":467,"range_type":477,"version_start":9,"version_start_type":9,"version_end":469,"version_end_type":470,"fixed_in":9},"lt3_2_13","ecosystem"]