CVE-2026-108598

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtim...

CVE-2026-108598

Floci versions 1.1.0 before 2.2.0 are vulnerable to a code injection flaw in the VtlTemplateEngine component. This vulnerability allows unauthenticated attackers to execute OS commands within the Floci JVM by creating a REST API with a MOCK integration . Attackers can leverage unrestricted Veloci...

EUVD-2026-96394

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtim...

CVE-2026-108598 Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtim...

CVE-2026-108598 Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtim...

GHSA-HF6X-8P5F-CGMF vulnerabilities

Vulnerabilities for packages: lmcache-cuda-12.8, kayenta, nacos, nuxeo, apache-nifi, traccar-fips, geoserver, airbyte-platform, floci-az, hadoop-fips, jbang, wazuh-indexer, wso2is, elasticsearch-fips, apicurio-registry-fips, opensearch, apicurio-registry, cassandra-reaper, reposilite, sonarqube,...

CVE-2026-54399 vulnerabilities

Vulnerabilities for packages: lmcache-cuda-12.8, kayenta, nacos, nuxeo, apache-nifi, traccar-fips, geoserver, airbyte-platform, floci-az, hadoop-fips, jbang, wazuh-indexer, wso2is, elasticsearch-fips, apicurio-registry-fips, opensearch, apicurio-registry, cassandra-reaper, reposilite, sonarqube,...

GHSA-QCXP-GM7M-4J5V vulnerabilities

Vulnerabilities for packages: apicurio-registry-fips, apicurio-registry, hono, keycloak-fips, floci-az, request-9047-keycloak-fips...

CVE-2026-50559 vulnerabilities

Vulnerabilities for packages: apicurio-registry-fips, apicurio-registry, hono, keycloak-fips, floci-az, request-9047-keycloak-fips...

GHSA-MFG7-5GFP-C4W3 vulnerabilities

Vulnerabilities for packages: strimzi-kafka-operator, commercial-elasticsearch, kayenta, kafbat-ui-fips, apache-nifi, traccar-fips, hadoop-fips, kafka-bridge-fips, celeborn, spark, seata, elasticsearch-fips, spark-kubernetes-operator-fips, apicurio-registry-fips, opensearch, apicurio-registry,...

GHSA-Q6CQ-MHR2-JMR5 vulnerabilities

Vulnerabilities for packages: neo4j, floci-az, hadoop-fips, celeborn, seata, apicurio-registry-fips, apicurio-registry, apache-pulsar, knative-kafka-broker-fips, keycloak-fips, apache-hop, apache-activemq-artemis, request-9047-keycloak-fips, pinot, apache-hop-fips, apache-pulsar-fips, pinot-fips,...

CVE-2026-55851 vulnerabilities

Vulnerabilities for packages: neo4j, floci-az, hadoop-fips, celeborn, seata, apicurio-registry-fips, apicurio-registry, apache-pulsar, knative-kafka-broker-fips, keycloak-fips, apache-hop, apache-activemq-artemis, request-9047-keycloak-fips, pinot, apache-hop-fips, apache-pulsar-fips, pinot-fips,...

CVE-2026-59919 vulnerabilities

Vulnerabilities for packages: neo4j, floci-az, hadoop-fips, celeborn, seata, apicurio-registry-fips, apicurio-registry, apache-pulsar, knative-kafka-broker-fips, keycloak-fips, apache-hop, apache-activemq-artemis, request-9047-keycloak-fips, pinot, apache-hop-fips, apache-pulsar-fips, pinot-fips,...

GHSA-WH89-7897-X99H vulnerabilities

Vulnerabilities for packages: neo4j, floci-az, hadoop-fips, celeborn, seata, apicurio-registry-fips, apicurio-registry, apache-pulsar, knative-kafka-broker-fips, keycloak-fips, apache-hop, apache-activemq-artemis, request-9047-keycloak-fips, pinot, apache-hop-fips, apache-pulsar-fips, pinot-fips,...

CVE-2026-54291 vulnerabilities

Vulnerabilities for packages: kayenta, nacos, nuxeo, traccar-fips, geoserver, guacamole-client, dependency-track, seata, apicurio-registry-fips, flyway-fips, apicurio-registry, sonarqube, keycloak-fips, apache-hop, request-9047-keycloak-fips, conductor, airbyte-server, apache-hop-fips, camunda,...

GHSA-J92G-9F8W-J867 vulnerabilities

Vulnerabilities for packages: kayenta, nacos, nuxeo, traccar-fips, geoserver, guacamole-client, dependency-track, seata, apicurio-registry-fips, flyway-fips, apicurio-registry, sonarqube, keycloak-fips, apache-hop, request-9047-keycloak-fips, conductor, airbyte-server, apache-hop-fips, camunda,...