CVE-2026-52439 | Critical | 9.8 | 2026-07-23 | An issue in xiandafu beetl 3.20.2 allows a remote attacker to execute arbitrary code via the type.new function and the property reflection mechanism |
CVE-2026-65591 | High | 8.8 | 2026-07-22 | n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modif… |
CVE-2026-57281 | High | 7.5 | 2026-06-24 | Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing att… |
CVE-2026-11561 | Critical | 9.8 | 2026-06-11 | Improper neutralization of special elements used in an expression language statement ('expression language injection') vulnerability in Soagen Informatics Tech… |
CVE-2026-40985 | Medium | 6.4 | 2026-06-11 | Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions.
Affected versions:
Spring Web Flow 4… |
CVE-2026-41729 | High | 8.1 | 2026-06-10 | Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) requests. Whe… |
CVE-2026-41719 | Medium | 6.4 | 2026-06-10 | A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates eva… |
CVE-2026-41717 | High | 8.1 | 2026-06-10 | Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defi… |
CVE-2026-8888 | High | 7.5 | 2026-06-03 | Version 3.0.7 of the Securly Chrome Extension downloads config.json over HTTP and compiles server-provided patterns as JavaScript regular expressions via new R… |
CVE-2026-44209 | High | 7.5 | 2026-05-26 | Banks generates meaningful LLM prompts using a template language that makes sense. Prior to 2.4.2, banks uses jinja2.Environment() (unsandboxed) to render prom… |
CVE-2026-2587 | Critical | 9.6 | 2026-05-19 | A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The a… |
CVE-2026-2586 | Critical | 9.1 | 2026-05-19 | An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send craft… |
CVE-2026-31380 | Medium | 6.5 | 2026-05-19 | Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache OFBiz.
This iss… |
CVE-2026-26462 | High | 7.3 | 2026-05-18 | Offline Hospital Management System 5.3.0 allows remote code execution due to an improper Electron renderer configuration. The application enables Node.js integ… |
CVE-2026-8759 | High | 7.3 | 2026-05-17 | A vulnerability was identified in xiandafu beetl up to 3.20.2. Affected is an unknown function of the file beetl-classic-integration/beetl-spring-classic/src/m… |
CVE-2026-41901 | Critical | 9.0 | 2026-05-12 | Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expr… |
CVE-2026-41705 | High | 8.6 | 2026-05-09 | Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs.
Spring AI 1.0.x: affecte… |
CVE-2026-41883 | High | 8.1 | 2026-05-08 | OmniFaces is a utility library for Faces. Prior to versions 1.14.2, 2.7.32, 3.14.16, 4.7.5, and 5.2.3, there is a server-side EL injection leading to Remote Co… |
CVE-2026-28201 | High | 7.8 | 2026-05-07 | An improper input validation, together with an overly permissive default CORS configuration in Open Notebook v1.8.1 allows remote attacker to trick a legitimat… |
CVE-2026-42811 | Critical | 9.9 | 2026-05-04 | In plain terms, Apache Polaris is supposed to issue short-lived GCS credentials
that
only work for one table's files, but a crafted namespace or table name can… |
CVE-2026-40897 | High | 8.8 | 2026-04-24 | Math.js is an extensive math library for JavaScript and Node.js. From 13.1.1 to before 15.2.0, a vulnerability allowed executing arbitrary JavaScript via the e… |
CVE-2026-40478 | Critical | 9.0 | 2026-04-17 | Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability i… |
CVE-2026-40477 | Critical | 9.0 | 2026-04-17 | Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability i… |
CVE-2026-39842 | Critical | 9.9 | 2026-04-15 | OpenRemote is an open-source IoT platform. Versions 1.21.0 and below contain two interrelated expression injection vulnerabilities in the rules engine that all… |
CVE-2026-34714 | Critical | 9.2 | 2026-03-30 | Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs w… |
CVE-2026-33943 | High | 8.8 | 2026-03-27 | Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In versions 15.10.0 through 20.8.7, a code injection vulnerabil… |
CVE-2026-33938 | High | 8.1 | 2026-03-27 | Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the `@partial-block` special variable is stored… |
CVE-2026-32695 | High | 7.7 | 2026-03-27 | Traefik is an HTTP reverse proxy and load balancer. Prior to versions 3.6.11 and 3.7.0-ea.2, Traefik's Knative provider builds router rules by interpolating us… |
CVE-2026-22738 | Critical | 9.8 | 2026-03-27 | In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could… |
CVE-2026-22729 | High | 8.6 | 2026-03-18 | A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through… |
CVE-2026-24713 | Critical | 9.8 | 2026-03-09 | Improper Input Validation vulnerability in Apache IoTDB.
This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7.
Users are recomme… |
CVE-2026-24737 | High | 8.1 | 2026-02-02 | jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of properties and methods of the Acroform module allows users to inject arbitra… |
CVE-2025-11175 | | | 2026-01-30 | Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in The Wikimedia Foundatio… |
CVE-2025-41253 | High | 7.5 | 2025-10-16 | The following versions of Spring Cloud Gateway Server Webflux may be vulnerable to the ability to expose environment variables and system properties to attacke… |
CVE-2025-41243 | Critical | 10.0 | 2025-09-16 | Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification.
An application should be considered vulnerable when all the… |
CVE-2025-3322 | | | 2025-06-06 | An improper neutralization of inputs used in expression
language allows remote code execution with the highest privileges on the
server. |
CVE-2024-51466 | Critical | 9.0 | 2024-12-20 | IBM Cognos Analytics 11.2.0 through 11.2.4 FP4 and
12.0.0 through 12.0.4
is vulnerable to an Expression Language (EL) Injection vulnerability. A remote atta… |
CVE-2024-12798 | | | 2024-12-19 | ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core
upto including version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 in Java applications allows
… |
CVE-2024-9672 | Medium | 5.4 | 2024-12-10 | A reflected cross-site scripting (XSS) vulnerability exists in PaperCut NG/MF. This issue can be used to execute specially created JavaScript payloads in the b… |
CVE-2024-7552 | Medium | 6.3 | 2024-08-06 | A vulnerability was found in DataGear up to 5.0.0. It has been declared as critical. Affected by this vulnerability is the function evaluateVariableExpression… |
CVE-2024-5828 | High | 8.6 | 2024-08-06 | Expression Language Injection vulnerability in Hitachi Tuning Manager on Windows, Linux, Solaris allows Code Injection.This issue affects Hitachi Tuning Manage… |
CVE-2024-4286 | Medium | 4.9 | 2024-05-26 | Mintplex-Labs' anything-llm application is vulnerable to improper neutralization of special elements used in an expression language statement, identified in th… |
CVE-2023-51593 | Critical | 9.8 | 2024-05-03 | Voltronic Power ViewPower Pro Expression Language Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar… |
CVE-2024-0715 | High | 7.6 | 2024-02-20 | Expression Language Injection vulnerability in Hitachi Global Link Manager on Windows allows Code Injection.This issue affects Hitachi Global Link Manager: bef… |
CVE-2023-42658 | High | 8.8 | 2023-10-31 |
Archive command in Chef InSpec prior to 4.56.58 and 5.22.29 allow local command execution via maliciously crafted profile. |
CVE-2023-41331 | Critical | 9.8 | 2023-09-12 | SOFARPC is a Java RPC framework. Versions prior to 5.11.0 are vulnerable to remote command execution. Through a carefully
crafted payload, an attacker can achi… |
CVE-2022-4146 | High | 7.3 | 2023-07-18 | Expression Language Injection vulnerability in Hitachi Replication Manager on Windows, Linux, Solaris allows Code Injection.This issue affects Hitachi Replicat… |
CVE-2022-45855 | High | 8.0 | 2023-07-12 | SpringEL injection in the metrics source in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. User… |
CVE-2022-42009 | High | 8.0 | 2023-07-12 | SpringEL injection in the server agent in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users… |
CVE-2023-32200 | High | 8.8 | 2023-07-12 | There is insufficient restrictions of called script functions in Apache Jena
versions 4.8.0 and earlier. It allows a
remote user to execute javascript via a… |
CVE-2023-22665 | Medium | 5.4 | 2023-04-25 | There is insufficient checking of user queries in Apache Jena versions 4.7.0 and earlier, when invoking custom scripts. It allows a remote user to execute arbi… |
CVE-2023-20863 | Medium | 6.5 | 2023-04-13 | In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may c… |
CVE-2023-27821 | Critical | 9.8 | 2023-03-28 | Databasir v1.0.7 was discovered to contain a remote code execution (RCE) vulnerability via the mockDataScript parameter. |
CVE-2023-26092 | Critical | 9.8 | 2023-02-20 | Liima before 1.17.28 allows server-side template injection. |
CVE-2022-23504 | Medium | 5.7 | 2022-12-14 | TYPO3 is an open source PHP based web content management system. Versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are subject to Sensitive Information Di… |
CVE-2022-23463 | Critical | 9.4 | 2022-09-24 | Nepxion Discovery is a solution for Spring Cloud. Discover is vulnerable to SpEL Injection in discovery-commons. DiscoveryExpressionResolver’s eval method is e… |
CVE-2022-34466 | Medium | 6.5 | 2022-07-12 | A vulnerability has been identified in Mendix Applications using Mendix 9 (All versions >= V9.11 < V9.15), Mendix Applications using Mendix 9 (V9.12) (All vers… |
CVE-2022-22980 | Critical | 9.8 | 2022-06-23 | A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain… |
CVE-2022-26134 | Critical | 9.8 | 2022-06-03 | In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbit… |
CVE-2022-26111 | High | 8.8 | 2022-04-25 | The BeanShell components of IRISNext through 9.8.28 allow execution of arbitrary commands on the target server by creating a custom search (or editing an exist… |
CVE-2022-24847 | High | 7.2 | 2022-04-13 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The GeoServer security mechanism can perform a… |
CVE-2022-24818 | High | 8.2 | 2022-04-13 | GeoTools is an open source Java library that provides tools for geospatial data. The GeoTools library has a number of data sources that can perform unchecked J… |
CVE-2021-31805 | Critical | 9.8 | 2022-04-12 | The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation i… |
CVE-2022-22963 | Critical | 9.8 | 2022-04-01 | In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a speciall… |
CVE-2022-22947 | Critical | 10.0 | 2022-03-03 | In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enab… |
CVE-2021-45046 | Critical | 9.0 | 2021-12-14 | It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers wi… |
CVE-2021-44228 | Critical | 10.0 | 2021-12-10 | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameter… |
CVE-2021-32834 | High | 8.2 | 2021-09-09 | Eclipse Keti is a service that was designed to protect RESTfuls API using Attribute Based Access Control (ABAC). In Keti a user able to create Policy Sets can… |
CVE-2021-26084 | Critical | 9.8 | 2021-08-30 | In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbit… |
CVE-2020-26565 | High | 7.5 | 2021-07-31 | ObjectPlanet Opinio before 7.14 allows Expression Language Injection via the admin/permissionList.do from parameter. This can be used to retrieve possibly sens… |
CVE-2021-28170 | Medium | 5.3 | 2021-05-26 | In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if the… |
CVE-2020-17530 | Critical | 9.8 | 2020-12-11 | Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts… |
CVE-2020-7195 | High | 8.8 | 2020-10-19 | A iccselectrules expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior… |
CVE-2020-7194 | High | 8.8 | 2020-10-19 | A perfaddormoddevicemonitor expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version… |
CVE-2020-7193 | High | 8.8 | 2020-10-19 | A ictexpertcsvdownload expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s)… |
CVE-2020-7192 | High | 8.8 | 2020-10-19 | A devicethresholdconfig expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s)… |
CVE-2020-7191 | High | 8.8 | 2020-10-19 | A devsoftsel expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to i… |
CVE-2020-7190 | High | 8.8 | 2020-10-19 | A deviceselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to… |
CVE-2020-7189 | High | 8.8 | 2020-10-19 | A faultflasheventselectfact expression language injectionremote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(… |
CVE-2020-7188 | High | 8.8 | 2020-10-19 | A userselectpagingcontent expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s… |
CVE-2020-7187 | High | 8.8 | 2020-10-19 | A reportpage index expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prio… |
CVE-2020-7186 | High | 8.8 | 2020-10-19 | A powershellconfigcontent expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s… |
CVE-2020-7185 | High | 8.8 | 2020-10-19 | A tvxlanlegend expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to… |
CVE-2020-7184 | High | 8.8 | 2020-10-19 | A viewbatchtaskresultdetailfact expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) ver… |
CVE-2020-7183 | High | 8.8 | 2020-10-19 | A forwardredirect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior… |
CVE-2020-7182 | High | 8.8 | 2020-10-19 | A sshconfig expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iM… |
CVE-2020-7181 | High | 8.8 | 2020-10-19 | A smsrulesdownload expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prio… |
CVE-2020-7180 | High | 8.8 | 2020-10-19 | A ictexpertdownload expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Pri… |
CVE-2020-7179 | High | 8.8 | 2020-10-19 | A thirdpartyperfselecttask expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(… |
CVE-2020-7178 | High | 8.8 | 2020-10-19 | A mediaforaction expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior… |
CVE-2020-7177 | High | 8.8 | 2020-10-19 | A wmiconfigcontent expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prio… |
CVE-2020-7176 | High | 8.8 | 2020-10-19 | A viewtaskresultdetailfact expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(… |
CVE-2020-7175 | High | 8.8 | 2020-10-19 | A iccselectdymicparam expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): P… |
CVE-2020-7174 | High | 8.8 | 2020-10-19 | A soapconfigcontent expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Pri… |
CVE-2020-7173 | High | 8.8 | 2020-10-19 | A actionselectcontent expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): P… |
CVE-2020-7172 | Critical | 9.8 | 2020-10-19 | A templateselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior… |
CVE-2020-7171 | Critical | 9.8 | 2020-10-19 | A guidatadetail expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior t… |
CVE-2020-7170 | Critical | 9.8 | 2020-10-19 | A select expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC P… |
CVE-2020-7169 | Critical | 9.8 | 2020-10-19 | A ictexpertcsvdownload expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s)… |
CVE-2020-7168 | Critical | 9.8 | 2020-10-19 | A selectusergroup expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior… |