CVE-2026-73649

A flaw was found in Velocity.js, a JavaScript implementation of the Apache Velocity template engine. An incomplete fix for a previous vulnerability allowed an attacker to bypass security filters by using unfiltered property-read expressions in templates. This enables an attacker-controlled templa...