ESC15

TL;DR

ESC15 lets you inject arbitrary application policies in the issued certificate, allowing for certificates to have more dangerous permissions than configured to. This vulnerability relies on the template version.