ognl vulnerabilities

CVEs whose affected-version data names the ognl package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-113730Medium· 5.6

yesterday

OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies

OGNL is an Object Graph Navigation Library for Java. Prior to 3.4.13, the optional stricter-invocation mode in OgnlRuntime.invokeMethod checks the declaring class of the method that OGNL invokes but does not block java.lang.reflect.Metho…

▾ Sunlitorphan-oss · ognlvia CVEORG