https://vulnerability.circl.lu/sightings/feed 2026-10-12T05:35:22.553244+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/2c5d3d10-7d5e-40e0-be92-d6402626b46d/export 2026-10-12T05:35:22.579299+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "2c5d3d10-7d5e-40e0-be92-d6402626b46d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108598", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxkcaiy2ve2n", "content": "CVE-2026-108598\nVersions 1.1.0 up to but not including 2.2.0 of Floci let anyone send specially crafted templates that run operating\u2011system commands on the server. This could let attackers take control of the system hosting\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-10-10T20:10:05.267538Z"} 2026-10-10T20:10:05.267538+00:00 https://vulnerability.circl.lu/sighting/12352aa8-2c70-4467-b50d-7dc4ff08eddb/export 2026-10-12T05:35:22.581834+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "12352aa8-2c70-4467-b50d-7dc4ff08eddb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108598", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxkc475i5t2l", "content": "\ud83d\udea8 CVE-2026-108598 \u2014 CVSS 9.3 CRITICAL\n\nFloci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthent...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-108598\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-10T20:07:40.476838Z"} 2026-10-10T20:07:40.476838+00:00 https://vulnerability.circl.lu/sighting/3869210a-d525-4a62-958a-0a61d48585f3/export 2026-10-12T05:35:22.581982+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "3869210a-d525-4a62-958a-0a61d48585f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108598", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxka3jqqyk2a", "content": "\ud83d\udd34 CVE-2026-108598 - Critical (9.8)\n\nFloci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-108598/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-10T19:31:31.152479Z"} 2026-10-10T19:31:31.152479+00:00 https://vulnerability.circl.lu/sighting/05692309-4177-4cc4-925c-550facebd0ec/export 2026-10-12T05:35:22.582101+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "05692309-4177-4cc4-925c-550facebd0ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108598", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418160135251747", "content": "CVE-2026-108598 Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder, executing OS commands in the Floci JVM.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108598https://github.com/floci-io/floci/security/advisories/GHSA-3p4c-wp7w-mgjxhttps://github.com/ghostx-86/exploitarium/tree/main/floci-apigateway-vtl-rce-pochttps://github.com/floci-io/floci/commit/144b90e6fa861a5ac882e99a090d503da01945c4https://github.com/floci-io/floci/releases/tag/2.2.0https://github.com/floci-io/floci/blob/560b3e4aae61cea3ac7d4d51843bdffd0e3085fd/src/main/java/io/github/hectorvent/floci/services/apigateway/VtlTemplateEngine.java#L74-L114https://github.com/floci-io/flocihttps://www.vulncheck.com/advisories/floci-1.1.0-before-2.2.0-rce-via-api-gateway-vtl-mapping-templates#floci-io #floci#CVE_2026_108598#bot", "creation_timestamp": "2026-10-10T19:02:18.114924Z"} 2026-10-10T19:02:18.114924+00:00