Shepherdwind Velocity.js vulnerabilities

• shepherdwind velocity.js Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of CVE-2026-44966 fix) CVE-2026-73649 Fix available 9.8 CriticalJuly 22, 2026
• shepherdwind velocity.js Velocity.js: Prototype Pollution in #set path assignment CVE-2026-44966 8.3 HighMay 9, 2026