https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-13T23:23:09.275486+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-108598 CVE-2026-108598 — Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates 2026-10-13T23:23:09.276997+00:00

Affected: floci-io floci

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder, executing OS commands in the Floci JVM.