CyberSecBulletin

Shepherdwind vulnerabilities

We track 2 vulnerabilities in Shepherdwind products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on August 13, 2026.

2vulnerabilities
2critical
0high
0exploited
9.8average CVSS score

Latest Shepherdwind vulnerabilities

  • 9.8 Critical severity

    velocity.js: Improper Control of Generation of Code

    CVE-2026-73649Shepherdwind

    Velocity.js is a JavaScript implementation of the Apache Velocity template engine. Prior to 2.1.7, the earlier fix for CVE-2026-44966 filtered constructor, __proto__, and prototype only in the #set assignment handler in src/compile/set.ts, while property-read

  • 9.8 Critical severity

    velocity.js: Improperly Controlled Modification of Object Prototype Attributes

    CVE-2026-44966Shepherdwind

    Velocity.js is a JavaScript implementation of the Apache Velocity template engine. In 2.1.5 and earlier, a prototype pollution vulnerability was discovered in velocityjs. This issue occurs during the processing of #set directives in Velocity templates. If an a