CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

Incomplete fix for Apache Log4j vulnerability

Jenkins Script Security Plugin has a script security bypass vulnerability

Spring Web Flow has Data Binding Vulnerability with Unified EL Parser

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch requests

Spring Data MongoDB is vulnerable to SpEL (Spring Expression Language) expression injection

Spring Data KeyValue: Remote code execution via SpEL Injection in Sort-based repository queries

n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution

Duplicate Advisory: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution

GlassFish's gadget handler is vulnerable to RCE

Caddy CVE-2026-30852 Fix Bypass

Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs

Sandboxed Thymeleaf expressions vulnerable to improper recognition of unauthorized syntax patterns

Spring AI: SpEL injection is triggered when a user-supplied value is used as a filter expression key

OmniFaces: EL injection via crafted resource name in wildcard CDN mapping

Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf

Improper restriction of the scope of accessible objects in Thymeleaf expressions

Expression Injection in OpenRemote

JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter

Apache IoTDB has an Improper Input Validation vulnerability

Spring Cloud Gateway Server Webflux is vulnerable to Expression Language Injection

Spring Cloud Function Code Injection with a specially crafted SpEL as a routing expression

Remote code injection in Log4j

Remote code execution in Apache Struts

Nexus Repository Manager 3 - Remote Code Execution

Hutool allows remote code execution (RCE) via the QLExpressEngine class