template-injection

• CVE-2026-46640 - Twig macro-reference compilation RCE 2026-06-07
• CVE-2026-47732 - Twig toString sandbox bypass 2026-06-07