CWE-917
213 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 9 of them as exploited in the wild.
- Published CVEs
- 213
- Last 12 months
- 40
- Critical
- 79
- Known exploited
- 9
Critical 79High 119Medium 15Low 0Not scored 0
CVEs per yearBy the year they were published
- 20101
- 20183
- 201963
- 202068
- 20216
- 202211
- 202310
- 20248
- 20253
- 202640
Known exploitedNewest addition to KEV first
- CVE-2021-45046
Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack
Apache Software Foundation · Apache Log4j
ExploitedCritical9.0 - CVE-2022-22963
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a…
Spring Cloud Function
ExploitedCritical9.8 - CVE-2022-26134
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute…
Atlassian · Confluence Data Center
ExploitedCritical9.8 - CVE-2022-22947
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is…
Spring Cloud Gateway
ExploitedCritical10.0 - CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
Apache Software Foundation · Apache Log4j2
ExploitedCritical10.0 - CVE-2010-1871
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression…
Product not named
ExploitedHigh8.8 - CVE-2021-26084
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute…
Atlassian · Confluence Server
ExploitedCritical9.8 - CVE-2020-17530
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts…
Apache Software Foundation · Apache Struts
ExploitedCritical9.8 - CVE-2020-10199
Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).
Product not named
ExploitedHigh8.8
Newest CVEs
- CVE-2026-95664
Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions
Apache Software Foundation · Apache Camel
Medium5.4 - CVE-2026-109432
Camunda Expression Injection via orQueries RCE
Camunda · Camunda 7
Critical9.3 - CVE-2026-83531
Apache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplied by Control Messages
Apache Software Foundation · Apache Camel
High8.8 - CVE-2026-108334
Github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-operator-product-build/kuadrant-operator: kuadrant-operator: crafted httproute match values can bypass gateway policy overrides
Red Hat · Red Hat Connectivity Link 1.4
High7.4 - CVE-2026-104711
Apache Struts: OGNL injection in the legacy RESTful action mapper
Apache Software Foundation · Apache Struts
Critical9.8 - CVE-2026-87830
Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks.
Apache Software Foundation · Apache WSS4J
Critical9.1 - CVE-2026-91145
Activiti through 7.1.0.M6 Expression Injection via Mail Task
Activiti · Activiti
High7.1 - CVE-2026-52439
An issue in xiandafu beetl 3.20.2 allows a remote attacker to execute arbitrary code via the type.new function and the property reflection mechanism
Product not named
Critical9.8 - CVE-2026-65591
n8n before 1.123.64 Sanitizer Bypass Remote Code Execution
n8n-io · n8n
High8.9 - CVE-2026-57281
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing…
Jenkins Project · Jenkins Script Security Plugin
High7.5