CVE-2026-69100

HighCVSS 8.8/10Last modified Oct 23, 2026

Description

LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains a remote code execution vulnerability in GlueFactory that executes unsandboxed Groovy scripts from database template fields without compilation restrictions or whitelisting. Attackers can write or influence the script field via message template endpoints to execute arbitrary Groovy code and OS commands on the backend server.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Aug 4, 2026
Last modified: Oct 23, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-691017.7Datavane TIS v5.0.0 contains an XML external entity (XXE) injection vulnerability that allows authenticated attackers to perform server-side CVE-2026-691029.8MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows una CVE-2026-691047.6An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information CVE-2026-691058.1An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integ CVE-2026-691068.8A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted con CVE-2026-691075.9An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions.CVE-2026-691086.0A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.1). The affected application is vulnerable to a local CVE-2026-691097.5A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.3). The affected application is vulnerable to a path CVE-2026-69119.8Missing JWT signature verification in AWS Ops Wheel allows unauthenticated attackers to forge JWT tokens and gain unintended administrative CVE-2026-691109.1OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary CVE-2026-691117.5Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vulnerability that allows remote attackers to terminate servic CVE-2026-691127.1Hugging Face Accelerate through 1.14.0 contains a path traversal vulnerability in load_checkpoint_in_model and load_checkpoint_and_dispatch