[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-74790":6},{"stargazers_count":4,"fetched_at":5},7,"2026-08-16T16:37:20.960Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":294,"aliases":295,"duplicate_of":9,"upstream":296,"downstream":297,"duplicates":298,"related":299,"reserved_at":9,"published_at":300,"modified_at":300,"state":301,"summary":302,"references_raw":309,"kevs":321,"epss":9,"epss_history":322,"metrics":323,"affected":336},"CVE-2026-74790","Scriban before 7.0.0 caches TypedObjectAccessor by Type only without considering MemberFilter changes, allowing reused TemplateContext instances to expose members that should be hidden. Attackers can access filtered properties and fields by reusing a TemplateContext after tightening its MemberFilter, bypassing sandbox policies across requests or tenants.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":9,"capec":18},"CWE-693","Protection Mechanism Failure","The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.","weakness","Draft","Pillar",[19,67,71,130,172,176,180,184,188,192,202,206,223,227,238,286,290],{"id":20,"name":21,"techniques":22},"CAPEC-1","Accessing Functionality Not Properly Constrained by ACLs",[23],{"id":24,"name":25,"tactics":26,"countermeasures":42},"T1574.010","Services File Permissions Weakness",[27,30,33,36,39],{"id":28,"name":29},"TA0110","Persistence",{"id":31,"name":32},"TA0111","Privilege Escalation",{"id":34,"name":35},"TA0030","Defense Evasion",{"id":37,"name":38},"TA0005","Stealth",{"id":40,"name":41},"TA0104","Execution",[43,48,53,58,63],{"id":44,"name":45,"tactic":46},"D3-RS","Restore Software",{"name":47},"Restore",{"id":49,"name":50,"tactic":51},"D3-SWI","Software Inventory",{"name":52},"Model",{"id":54,"name":55,"tactic":56},"D3-SBV","Service Binary Verification",{"name":57},"Detect",{"id":59,"name":60,"tactic":61},"D3-SU","Software Update",{"name":62},"Harden",{"id":64,"name":65,"tactic":66},"D3-AVE","Asset Vulnerability Enumeration",{"name":52},{"id":68,"name":69,"techniques":70},"CAPEC-107","Cross Site Tracing",[],{"id":72,"name":73,"techniques":74},"CAPEC-127","Directory Indexing",[75],{"id":76,"name":77,"tactics":78,"countermeasures":82},"T1083","File and Directory Discovery",[79],{"id":80,"name":81},"TA0102","Discovery",[83,88,93,97,101,105,109,114,118,122,126],{"id":84,"name":85,"tactic":86},"D3-FEV","File Eviction",{"name":87},"Evict",{"id":89,"name":90,"tactic":91},"D3-RFAM","Remote File Access Mediation",{"name":92},"Isolate",{"id":94,"name":95,"tactic":96},"D3-CQ","Content Quarantine",{"name":92},{"id":98,"name":99,"tactic":100},"D3-LFP","Local File Permissions",{"name":92},{"id":102,"name":103,"tactic":104},"D3-CM","Content Modification",{"name":92},{"id":106,"name":107,"tactic":108},"D3-FE","File Encryption",{"name":62},{"id":110,"name":111,"tactic":112},"D3-DF","Decoy File",{"name":113},"Deceive",{"id":115,"name":116,"tactic":117},"D3-CF","Content Filtering",{"name":92},{"id":119,"name":120,"tactic":121},"D3-FIM","File Integrity Monitoring",{"name":57},{"id":123,"name":124,"tactic":125},"D3-RF","Restore File",{"name":47},{"id":127,"name":128,"tactic":129},"D3-FA","File Analysis",{"name":57},{"id":131,"name":132,"techniques":133},"CAPEC-17","Using Malicious Files",[134,154],{"id":135,"name":136,"tactics":137,"countermeasures":143},"T1574.005","Executable Installer File Permissions Weakness",[138,139,140,141,142],{"id":28,"name":29},{"id":31,"name":32},{"id":34,"name":35},{"id":37,"name":38},{"id":40,"name":41},[144,146,148,150,152],{"id":59,"name":60,"tactic":145},{"name":62},{"id":64,"name":65,"tactic":147},{"name":52},{"id":49,"name":50,"tactic":149},{"name":52},{"id":54,"name":55,"tactic":151},{"name":57},{"id":44,"name":45,"tactic":153},{"name":47},{"id":24,"name":25,"tactics":155,"countermeasures":161},[156,157,158,159,160],{"id":28,"name":29},{"id":31,"name":32},{"id":34,"name":35},{"id":37,"name":38},{"id":40,"name":41},[162,164,166,168,170],{"id":44,"name":45,"tactic":163},{"name":47},{"id":49,"name":50,"tactic":165},{"name":52},{"id":54,"name":55,"tactic":167},{"name":57},{"id":59,"name":60,"tactic":169},{"name":62},{"id":64,"name":65,"tactic":171},{"name":52},{"id":173,"name":174,"techniques":175},"CAPEC-20","Encryption Brute Forcing",[],{"id":177,"name":178,"techniques":179},"CAPEC-22","Exploiting Trust in Client",[],{"id":181,"name":182,"techniques":183},"CAPEC-237","Escaping a Sandbox by Calling Code in Another Language",[],{"id":185,"name":186,"techniques":187},"CAPEC-36","Using Unpublished Interfaces or Functionality",[],{"id":189,"name":190,"techniques":191},"CAPEC-477","Signature Spoofing by Mixing Signed and Unsigned Content",[],{"id":193,"name":194,"techniques":195},"CAPEC-480","Escaping Virtualization",[196],{"id":197,"name":198,"tactics":199,"countermeasures":201},"T1611","Escape to Host",[200],{"id":31,"name":32},[],{"id":203,"name":204,"techniques":205},"CAPEC-51","Poison Web Service Registry",[],{"id":207,"name":208,"techniques":209},"CAPEC-57","Utilizing REST's Trust in the System Resource to Obtain Sensitive Data",[210],{"id":211,"name":212,"tactics":213,"countermeasures":218},"T1040","Network Sniffing",[214,217],{"id":215,"name":216},"TA0031","Credential Access",{"id":80,"name":81},[219],{"id":220,"name":221,"tactic":222},"D3-DNSTA","DNS Traffic Analysis",{"name":57},{"id":224,"name":225,"techniques":226},"CAPEC-59","Session Credential Falsification through Prediction",[],{"id":228,"name":229,"techniques":230},"CAPEC-65","Sniff Application Code",[231],{"id":211,"name":212,"tactics":232,"countermeasures":235},[233,234],{"id":215,"name":216},{"id":80,"name":81},[236],{"id":220,"name":221,"tactic":237},{"name":57},{"id":239,"name":240,"techniques":241},"CAPEC-668","Key Negotiation of Bluetooth Attack (KNOB)",[242],{"id":243,"name":244,"tactics":245,"countermeasures":249},"T1565.002","Transmitted Data Manipulation",[246],{"id":247,"name":248},"TA0105","Impact",[250,254,258,262,266,270,274,278,282],{"id":251,"name":252,"tactic":253},"D3-APCA","Application Protocol Command Analysis",{"name":57},{"id":255,"name":256,"tactic":257},"D3-CSPP","Client-server Payload Profiling",{"name":57},{"id":259,"name":260,"tactic":261},"D3-PHDURA","Per Host Download-Upload Ratio Analysis",{"name":57},{"id":263,"name":264,"tactic":265},"D3-UGLPA","User Geolocation Logon Pattern Analysis",{"name":57},{"id":267,"name":268,"tactic":269},"D3-NTCD","Network Traffic Community Deviation",{"name":57},{"id":271,"name":272,"tactic":273},"D3-NTF","Network Traffic Filtering",{"name":92},{"id":275,"name":276,"tactic":277},"D3-PMAD","Protocol Metadata Anomaly Detection",{"name":57},{"id":279,"name":280,"tactic":281},"D3-RTSD","Remote Terminal Session Detection",{"name":57},{"id":283,"name":284,"tactic":285},"D3-NTSA","Network Traffic Signature Analysis",{"name":57},{"id":287,"name":288,"techniques":289},"CAPEC-74","Manipulating State",[],{"id":291,"name":292,"techniques":293},"CAPEC-87","Forceful Browsing",[],[],[],[],[],[],[],"2026-08-16T13:14:14.417Z","Received",{"cisa_kev":303,"cisa_ransomware":303,"cisa_vendor":9,"epss_severity":9,"epss_score":9,"severity":304,"severity_score":305,"severity_version":306,"severity_source":307,"severity_vector":308,"severity_status":301},false,"critical",9.3,"v4.0","cve.org","CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",[310,316],{"url":311,"sources":312,"tags":314},"https://github.com/scriban/scriban/security/advisories/GHSA-5wr9-m6jw-xx44",[307,313],"nvd",[315],"Vendor Advisory",{"url":317,"sources":318,"tags":319},"https://www.vulncheck.com/advisories/scriban-before-memberfilter-bypass-via-templatecontext-cache",[307,313],[320],"Third Party Advisory",[],[],[324,332],{"source":307,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":325,"cvss_v4_0":331},{"baseScore":326,"baseSeverity":327,"vectorString":328,"impactScore":329,"exploitabilityScore":330},9.1,"CRITICAL","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",8.7,10,{"baseScore":305,"baseSeverity":327,"vectorString":308,"impactScore":9,"exploitabilityScore":9},{"source":313,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":333,"cvss_v4_0":334},{"baseScore":326,"baseSeverity":327,"vectorString":328,"impactScore":329,"exploitabilityScore":330},{"baseScore":305,"baseSeverity":327,"vectorString":335,"impactScore":9,"exploitabilityScore":9},"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",[337],{"ecosystem":9,"name":338,"vendor":338,"product":338,"cpe_part":339,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":340},"scriban","a",[341],{"version":342,"is_range":343,"range_type":307,"version_start":9,"version_start_type":9,"version_end":344,"version_end_type":345,"fixed_in":9},"\u003C 7.0.0",true,"7.0.0","excluding"]