Tag
critical
advisory
Eclipse GlassFish EL Injection Vulnerability (CVE-2026-2587) Exploit Publicly Available
2 rules 1 TTP 1 CVEA remote code execution vulnerability (CVE-2026-2587) exists in Eclipse GlassFish due to unsanitized user-supplied values in XML attributes being evaluated by the Java Expression Language (EL) engine, and a public exploit is now available.
GlassFish
rce
el-injection
cve-2026-2587
2r
1t
1c
high
advisory
OmniFaces EL Injection Vulnerability via Crafted Resource Name
2 rules 1 TTPA server-side EL injection vulnerability exists in OmniFaces when using CDNResourceHandler with wildcard CDN mappings, allowing attackers to inject EL expressions in resource names leading to potential remote code execution, information disclosure, or denial of service.
OmniFaces
el-injection
rce
cdn
2r
1t