[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-74791":6},{"stargazers_count":4,"fetched_at":5},7,"2026-08-16T16:37:20.960Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":125,"aliases":126,"duplicate_of":9,"upstream":127,"downstream":128,"duplicates":129,"related":130,"reserved_at":9,"published_at":131,"modified_at":131,"state":132,"summary":133,"references_raw":140,"kevs":152,"epss":9,"epss_history":153,"metrics":154,"affected":168},"CVE-2026-74791","Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset() is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earlier renders without triggering TemplateLoader.Load() again.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":9,"capec":18},"CWE-226","Sensitive Information in Resource Not Removed Before Reuse","The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or \"zeroize\" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.","weakness","Draft","Base",[19],{"id":20,"name":21,"techniques":22},"CAPEC-37","Retrieve Embedded Sensitive Data",[23,81],{"id":24,"name":25,"tactics":26,"countermeasures":30},"T1005","Data from Local System",[27],{"id":28,"name":29},"TA0100","Collection",[31,36,41,46,50,55,59,64,69,73,77],{"id":32,"name":33,"tactic":34},"D3-RFAM","Remote File Access Mediation",{"name":35},"Isolate",{"id":37,"name":38,"tactic":39},"D3-DF","Decoy File",{"name":40},"Deceive",{"id":42,"name":43,"tactic":44},"D3-RF","Restore File",{"name":45},"Restore",{"id":47,"name":48,"tactic":49},"D3-CQ","Content Quarantine",{"name":35},{"id":51,"name":52,"tactic":53},"D3-FE","File Encryption",{"name":54},"Harden",{"id":56,"name":57,"tactic":58},"D3-CM","Content Modification",{"name":35},{"id":60,"name":61,"tactic":62},"D3-FEV","File Eviction",{"name":63},"Evict",{"id":65,"name":66,"tactic":67},"D3-FA","File Analysis",{"name":68},"Detect",{"id":70,"name":71,"tactic":72},"D3-CF","Content Filtering",{"name":35},{"id":74,"name":75,"tactic":76},"D3-FIM","File Integrity Monitoring",{"name":68},{"id":78,"name":79,"tactic":80},"D3-LFP","Local File Permissions",{"name":35},{"id":82,"name":83,"tactics":84,"countermeasures":88},"T1552.004","Private Keys",[85],{"id":86,"name":87},"TA0031","Credential Access",[89,93,97,101,105,109,113,117,121],{"id":90,"name":91,"tactic":92},"D3-CTS","Credential Transmission Scoping",{"name":35},{"id":94,"name":95,"tactic":96},"D3-CH","Credential Hardening",{"name":54},{"id":98,"name":99,"tactic":100},"D3-RIC","Reissue Credential",{"name":45},{"id":102,"name":103,"tactic":104},"D3-DUC","Decoy User Credential",{"name":40},{"id":106,"name":107,"tactic":108},"D3-CR","Credential Revocation",{"name":63},{"id":110,"name":111,"tactic":112},"D3-CCSA","Credential Compromise Scope Analysis",{"name":68},{"id":114,"name":115,"tactic":116},"D3-MFA","Multi-factor Authentication",{"name":54},{"id":118,"name":119,"tactic":120},"D3-CRO","Credential Rotation",{"name":54},{"id":122,"name":123,"tactic":124},"D3-ANCI","Authentication Cache Invalidation",{"name":63},[],[],[],[],[],[],"2026-08-16T13:14:15.049Z","Received",{"cisa_kev":134,"cisa_ransomware":134,"cisa_vendor":9,"epss_severity":9,"epss_score":9,"severity":135,"severity_score":136,"severity_version":137,"severity_source":138,"severity_vector":139,"severity_status":132},false,"critical",9.2,"v4.0","cve.org","CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",[141,147],{"url":142,"sources":143,"tags":145},"https://github.com/scriban/scriban/security/advisories/GHSA-x6m9-38vm-2xhf",[138,144],"nvd",[146],"Vendor Advisory",{"url":148,"sources":149,"tags":150},"https://www.vulncheck.com/advisories/scriban-before-authorization-bypass-via-stale-include-cache",[138,144],[151],"Third Party Advisory",[],[],[155,164],{"source":138,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":156,"cvss_v4_0":162},{"baseScore":157,"baseSeverity":158,"vectorString":159,"impactScore":160,"exploitabilityScore":161},8.6,"HIGH","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",6.7,10,{"baseScore":136,"baseSeverity":163,"vectorString":139,"impactScore":9,"exploitabilityScore":9},"CRITICAL",{"source":144,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":165,"cvss_v4_0":166},{"baseScore":157,"baseSeverity":158,"vectorString":159,"impactScore":160,"exploitabilityScore":161},{"baseScore":136,"baseSeverity":163,"vectorString":167,"impactScore":9,"exploitabilityScore":9},"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",[169],{"ecosystem":9,"name":170,"vendor":170,"product":170,"cpe_part":171,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":172},"scriban","a",[173],{"version":174,"is_range":175,"range_type":138,"version_start":9,"version_start_type":9,"version_end":176,"version_end_type":177,"fixed_in":9},"\u003C 7.0.0",true,"7.0.0","excluding"]