Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel AWS2-s3 component. This i...

CVE-2026-95664

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') v

来源摘录 · NVD

Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the application is conf...

CVE-2026-104711

Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') v

历史摘要 · 未重新核验 · NVD

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject express...

CVE-2026-91145

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to

历史摘要 · 未重新核验 · NVD

n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution

CVE-2026-65591

## Impact The legacy expression evaluator's computed-member sanitizer can be bypassed by an authenticated user with work

历史摘要 · 未重新核验 · GitHub Advisory

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can ...

CVE-2026-65591

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authentic

来源摘录 · NVD

n8n before 1.123.64 Sanitizer Bypass Remote Code Execution

CVE-2026-65591

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authentic

历史摘要 · 未重新核验 · OSV.dev

Improper neutralization of special elements used in an expression language statement ('expression language injection') vulnerability in Soagen Informatics Technologies Software ...

CVE-2026-11561

Improper neutralization of special elements used in an expression language statement ('expression language injection') v

历史摘要 · 未重新核验 · NVD

Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions. Affected versions: Spring Web Flow 4.0.0; 3.0.0 through...

CVE-2026-40985

Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions.

历史摘要 · 未重新核验 · NVD

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is...

CVE-2026-41719

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a rep

历史摘要 · 未重新核验 · GitHub Advisory

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when...

CVE-2026-41729

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (app

历史摘要 · 未重新核验 · GitHub Advisory

Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection...

CVE-2026-41717

Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs du

历史摘要 · 未重新核验 · GitHub Advisory

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) requests. When a persistent ent...

CVE-2026-41729

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (app

历史摘要 · 未重新核验 · NVD

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the Spe...

CVE-2026-41719

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a rep

历史摘要 · 未重新核验 · NVD

Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository que...

CVE-2026-41717

Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs du

历史摘要 · 未重新核验 · NVD

Caddy CVE-2026-30852 Fix Bypass

# ## TL;DR CVE-2026-30852 fixed double expansion in `vars_regexp` when the variable key is a placeholder (e.g. `{http

历史摘要 · 未重新核验 · GitHub Advisory

A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application process...

CVE-2026-2587

A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used

历史摘要 · 未重新核验 · NVD

An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send crafted requests that a...

CVE-2026-2586

An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user

历史摘要 · 未重新核验 · NVD

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache OFBiz. This issue affects Apache ...

CVE-2026-31380

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') v

历史摘要 · 未重新核验 · NVD

A vulnerability was identified in xiandafu beetl up to 3.20.2. Affected is an unknown function of the file beetl-classic-integration/beetl-spring-classic/src/main/java/org/beetl...

CVE-2026-8759

A vulnerability was identified in xiandafu beetl up to 3.20.2. Affected is an unknown function of the file beetl-classic

历史摘要 · 未重新核验 · NVD

Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution m...

CVE-2026-41901

Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security

历史摘要 · 未重新核验 · NVD