Activiti vulnerabilities
CVEs whose affected-version data names the Activiti package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-116058Medium· 6.3Alfresco Activiti JuelScriptEngine.java JuelScriptEngine.eval code injection
A vulnerability was found in Alfresco Activiti up to 7.21.0-rc.692. Affected by this issue is the function JuelScriptEngine.eval of the file JuelScriptEngine.java. Performing a manipulation results in code injection. The attack can be in…
▾ SunlitAlfresco · ActivitiEPSS 0.38%via CVEORG
CVE-2026-91145High· 7.1PoCActiviti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering
Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with #{ that are stored and later evaluated i…
▾ MidnightActiviti · ActivitiEPSS 0.42%via NVD