CVE-2026-71253None▾ SunlitUse of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon. ClassConverter loads & static-initializes an attacker-named class from untrusted JSON. This issue affects Apache J…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon.
ClassConverter loads & static-initializes an attacker-named class from untrusted JSON.
This issue affects Apache Johnzon: from 1.0.0 before 2.2.0.
Users are recommended to upgrade to version 1.3.1 (javax namespace) or 2.2.0 (jakarta specification namespace), which fixes the issue.
org.apache.johnzon:johnzon-mapper >= 2.0.0 < 2.2.0org.apache.johnzon:johnzon-mapper >= 1.0.0 < 1.3.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-70410High· 8.8Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite Avatica
CVE-2026-41871Critical· 9.8Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)
CVE-2026-41870High· 8.8Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)
CVE-2026-108776NoneApache Kylin: tables/names SparkSQL injection
CVE-2026-67249NoneApache Answer: Email Code Purpose Confusion May Allow Account Takeover
CVE-2026-108780NoneApache Kylin: Potential JDBC source configuration validation issue