CVE-2026-113730

OGNL is an Object Graph Navigation Library for Java. Prior to 3.4.13, the optional stricter-invocation mode in OgnlRuntime.invokeMethod checks the declaring class of the method that OGNL invokes but does not block java.lang.reflect.Method, java.lang.reflect.Constructor, or java.lang.reflect.Field...

resteasy security update

An update is available for resteasy. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list RESTEasy contains a JBoss project that provides frameworks to help build...

PT-2026-119529

Name of the Vulnerable Software and Affected Versions OGNL versions prior to 3.4.13 Description The optional stricter-invocation mode in the invokeMethod function of OgnlRuntime fails to block java.lang.reflect.Method, java.lang.reflect.Constructor, or java.lang.reflect.Field. This allows an...

Security Bulletin: IBM Guardium Data Protection is affected by security vulnerabilities (CVE-2026-19032, CVE-2026-83557)

Summary IBM Guardium Data Protection has addressed security vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-19032 DESCRIPTION: jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In...

CVE-2026-71253

Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Johnzon. ClassConverter loads & static-initializes an attacker-named class from untrusted JSON. This issue affects Apache Johnzon: from 1.0.0 before 2.2.0. Users are recommended to upgrade to...

EUVD-2026-104193

Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Johnzon. ClassConverter loads & static-initializes an attacker-named class from untrusted JSON. This issue affects Apache Johnzon: from 1.0.0 before 2.2.0. Users are recommended to upgrade to...

CVE-2026-71253 Apache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSON

Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Johnzon. ClassConverter loads & static-initializes an attacker-named class from untrusted JSON. This issue affects Apache Johnzon: from 1.0.0 before 2.2.0. Users are recommended to upgrade to...

CVE-2026-71253

A vulnerability in Apache Johnzon (versions 1.0.0 to before 2.2.0) allows a remote attacker to potentially execute arbitrary code by submitting a crafted JSON payload. The root cause is unsafe reflection within the ClassConverter component, where it loads and statically initializes an attacker-sp...

CVE-2026-71253 Apache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSON

Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Johnzon. ClassConverter loads & static-initializes an attacker-named class from untrusted JSON. This issue affects Apache Johnzon: from 1.0.0 before 2.2.0. Users are recommended to upgrade to...

CVE-2026-84176 Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflection

Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. createCorsHandler set Access-Control-Allow-Credentials: true outside the origin check, so the...

CVE-2026-84176 Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflection

Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. createCorsHandler set Access-Control-Allow-Credentials: true outside the origin check, so the...

CVE-2026-84176

The Apache Camel camel-platform-http-vertx component is vulnerable to a Permissive Cross-domain Policy with Untrusted Domains (CWE-942). The createCorsHandler() function incorrectly sets Access-Control-Allow-Credentials: true outside the origin check. When camel.server.cors.origins is unset, the ...

ALSA-2026:85234 Important: resteasy security update

RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful Java applications. It is a fully certified and portable implementation of the JAX-RS specification. Security Fixes: resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode...

PT-2026-117336

Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Johnzon. ClassConverter loads & static-initializes an attacker-named class from untrusted JSON. This issue affects Apache Johnzon: from 1.0.0 before 2.2.0. Users are recommended to upgrade to...

CVE-2026-71253: Use of Externally-Controlled Input to Select Classes or Code

Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Johnzon. ClassConverter loads & static-initializes an attacker-named class from untrusted JSON. This issue affects Apache Johnzon: from 1.0.0 before 2.2.0. Users are recommended to upgrade to...

CVE-2026-111440: Use of Externally-Controlled Input to Select Classes or Code

在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java 中，LogFactory 根据 JDBC 连接参数中的 logger 类名调用 Class.forName 加载类后，直接反射调用以 String 为参数的构造函数，再转换为 Log。缺少 asSubclassLog.class 校验，非 Log 实现类也会在类型检查前被实例化。因此，当攻击者可控制 JDBC URL 或连接属性中的 logger 类名，且客户端 classpath...

CVE-2026-97666

Sonatype Nexus Repository 3 is vulnerable to unsafe reflection via an ExtDirect endpoint . An unauthenticated remote attacker can provide controlled input to a Java class loading call, which allows them to determine if specific classes are present in the application. This vulnerability does not p...

CVE-2026-97666 Nexus Repository 3 - Unsafe Reflection in ExtDirect Repository Endpoint

Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an ExtDirect endpoint. This allows the attacker to learn whether specific classes are present in the application. The issue does not by itself allow code...

CVE-2026-108506

ZTE Z80 Ultra's system interfaces do not have robust invocation authentication, with inadequate access control. Third-party apps may call the interfaces through reflection and retrieve relevant information...

EUVD-2026-96303

ZTE Z80 Ultra's system interfaces do not have robust invocation authentication, with inadequate access control. Third-party apps may call the interfaces through reflection and retrieve relevant information...