{"vulnerability": "cve-2026-46636", "sightings": [{"uuid": "f27301ad-7d6f-4fee-9e63-ea659100c910", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-46636", "type": "seen", "source": "https://bsky.app/profile/symfony.com/post/3mmtlz35moz2y", "content": "\ud83d\udd10 CVE-2026-46636: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders\n\u27a1\ufe0f https://symfony.com/blog/cve-2026-46636-sandbox-filter-tag-and-function-allow-list-bypass-when-sandbox-state-changes-between-renders", "creation_timestamp": "2026-05-27T13:21:43.071095Z"}, {"uuid": "c2475c62-4994-471d-99f5-1d46094fad30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46636", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/dv5dn2j6bup6q", "content": "CVE-2026-46636 - Twig: Sandbox method allowlist bypass via `Markup` subclass\nCVE ID : CVE-2026-46636\n \n Published : Sept. 4, 2026, 10:17 p.m. | 20\u00a0minutes ago\n \n Description : Twig is a template language for PHP. From version 1.0.0 to before version 3.27.0, SecurityPolicy::che...", "creation_timestamp": "2026-09-04T22:44:55.661815Z"}, {"uuid": "f6407e58-f08f-44e4-b4c5-d6949cb20cba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46636", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mvc6gd7wua2v", "content": "CVE-2026-46636: Twig <3.27.0 sandbox bypass\u2014subclasses of Twig\\Markup expose all public methods, allowing arbitrary code execution. CVSS N/A, fix available. Update immediately to 3.27.0+. https://www.valtersit.com/cve/CVE-2026-46636/ #CVE #infosec #PHP", "creation_timestamp": "2026-09-12T03:50:04.387613Z"}, {"uuid": "8bca61f5-f09b-40c6-8b5e-0468b16acad1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46636", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117256028412859964", "content": "CVE-2026-46636: Twig <3.27.0 sandbox bypass\u2014subclasses of Twig\\Markup expose all public methods, allowing arbitrary code execution. CVSS N/A, fix available. Update immediately to 3.27.0+. https://www.valtersit.com/cve/CVE-2026-46636/ #CVE #infosec #PHP", "creation_timestamp": "2026-09-12T03:50:05.281757Z"}]}