EUVD-2026-96394

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtim...

CVE-2026-108598 Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtim...

CVE-2026-108598

Floci versions 1.1.0 before 2.2.0 are vulnerable to a code injection flaw in the VtlTemplateEngine component. This vulnerability allows unauthenticated attackers to execute OS commands within the Floci JVM by creating a REST API with a MOCK integration . Attackers can leverage unrestricted Veloci...

CVE-2026-54399 vulnerabilities

Vulnerabilities for packages: jbang, camunda-zeebe, nuxeo, traccar, airbyte-server, elasticsearch-fips, geoserver, flyway, apache-hop-fips, apicurio-registry, opensearch-fips, apache-hop, cassandra-reaper, wso2is, airbyte-platform-fips, elasticsearch, airbyte-platform, floci-az, reposilite,...

GHSA-HF6X-8P5F-CGMF vulnerabilities

Vulnerabilities for packages: jbang, camunda-zeebe, nuxeo, traccar, airbyte-server, elasticsearch-fips, geoserver, flyway, apache-hop-fips, apicurio-registry, opensearch-fips, apache-hop, cassandra-reaper, wso2is, airbyte-platform-fips, elasticsearch, airbyte-platform, floci-az, reposilite,...

CVE-2026-50559 vulnerabilities

Vulnerabilities for packages: keycloak-fips, floci-az, hono, apicurio-registry, apicurio-registry-fips, request-9047-keycloak-fips...

GHSA-QCXP-GM7M-4J5V vulnerabilities

Vulnerabilities for packages: keycloak-fips, floci-az, hono, apicurio-registry, apicurio-registry-fips, request-9047-keycloak-fips...

GHSA-MFG7-5GFP-C4W3 vulnerabilities

Vulnerabilities for packages: camunda-zeebe, traccar, airbyte-server, elasticsearch-fips, tinkerpop, apache-hop-fips, apicurio-registry, knative-kafka-broker-fips, apache-pulsar, opensearch-fips, apache-hop, infinispan, commercial-elasticsearch, keycloak, elasticsearch, apache-pulsar-fips,...

CVE-2026-55851 vulnerabilities

Vulnerabilities for packages: tinkerpop, apache-hop-fips, apicurio-registry, knative-kafka-broker-fips, apache-pulsar, apache-hop, keycloak, apache-pulsar-fips, knative-kafka-broker, floci-az, pinot-fips, apicurio-registry-fips, celeborn, seata, keycloak-fips, zipkin, thingsboard, neo4j,...

CVE-2026-59919 vulnerabilities

Vulnerabilities for packages: tinkerpop, apache-hop-fips, apicurio-registry, knative-kafka-broker-fips, apache-pulsar, apache-hop, keycloak, apache-pulsar-fips, knative-kafka-broker, floci-az, pinot-fips, apicurio-registry-fips, celeborn, seata, keycloak-fips, zipkin, thingsboard, neo4j,...

GHSA-Q6CQ-MHR2-JMR5 vulnerabilities

Vulnerabilities for packages: tinkerpop, apache-hop-fips, apicurio-registry, knative-kafka-broker-fips, apache-pulsar, apache-hop, keycloak, apache-pulsar-fips, knative-kafka-broker, floci-az, pinot-fips, apicurio-registry-fips, celeborn, seata, keycloak-fips, zipkin, thingsboard, neo4j,...

GHSA-WH89-7897-X99H vulnerabilities

Vulnerabilities for packages: tinkerpop, apache-hop-fips, apicurio-registry, knative-kafka-broker-fips, apache-pulsar, apache-hop, keycloak, apache-pulsar-fips, knative-kafka-broker, floci-az, pinot-fips, apicurio-registry-fips, celeborn, seata, keycloak-fips, zipkin, thingsboard, neo4j,...

CVE-2026-54291 vulnerabilities

Vulnerabilities for packages: camunda-zeebe, nuxeo, traccar, airbyte-server, geoserver, guacamole-client, flyway, apache-hop-fips, apicurio-registry, dependency-track, apache-hop, keycloak, ghidra, apicurio-registry-fips, kayenta, flyway-fips, traccar-fips, seata, keycloak-fips, thingsboard,...

GHSA-J92G-9F8W-J867 vulnerabilities

Vulnerabilities for packages: camunda-zeebe, nuxeo, traccar, airbyte-server, geoserver, guacamole-client, flyway, apache-hop-fips, apicurio-registry, dependency-track, apache-hop, keycloak, ghidra, apicurio-registry-fips, kayenta, flyway-fips, traccar-fips, seata, keycloak-fips, thingsboard,...