What’s Vulnerable › Products

shepherdwind velocity.js vulnerabilities

2 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 2 published in the last 12 months.

Check whether your shepherdwind velocity.js version is affected

Latest shepherdwind velocity.js vulnerabilities

• CVE-2026-73649 — Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of CVE-2026-44966 fix) (CVSS 9.8)
• CVE-2026-44966 — Velocity.js: Prototype Pollution in #set path assignment (CVSS 9.8)