velocityjs vulnerabilities (Root)

1 vulnerability.

• velocityjs Root Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of CVE-2026-44966 fix) CVE-2026-73649 Fix available 9.8 CriticalJuly 22, 2026