VDB
CVE-2026-113730
CVE-2026-113730
PUBLISHED
CVSS 5.599999904632568 MEDIUM
OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies
EPSS 0.39% · 33.6th percentile
Risk Scores
CVSS 3.1
5.599999904632568
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score
0.39%
33.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | thingsboard | 0 |
| Maven | ognl:ognl | 0 |
| orphan-oss | ognl | 0 |
| wolfi | thingsboard | 0 |
Timeline
- Oct 20, 2026 CVE Published
- Oct 21, 2026 CVE Updated
- Oct 21, 2026 EPSS Score
- Oct 21, 2026 Coalition ESS Score
- Oct 24, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 27, 2026 EPSS Score
- Oct 29, 2026 EPSS Score
- Oct 30, 2026 Security Advisory
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-113730 advisory
- https://github.com/advisories/GHSA-crwc-vw2r-qr6m advisory
- https://github.com/orphan-oss/ognl/security/advisories/GHSA-crwc-vw2r-qr6m url
- https://github.com/orphan-oss/ognl/commit/16396fa4b560221294c2ab9ca04b76b161115e7d patch
- https://github.com/orphan-oss/ognl/commit/f4c17f794754d516ea799c36ed8524d1b7fb98e2 patch
- https://github.com/orphan-oss/ognl/releases/tag/OGNL_3_4_13 url