Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

347new WordPress flaws this week

390,007entries in the database

103 results · page 1 of 3

Oct 5, 2026Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Struts.CVE-2026-104714 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served requests without isolation, so a value belonging to one user can appear in another user's response, or the rendering can fail and surface as a server error. Applications whose localized messages format no date or time arguments are not affected. This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0. Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
Product
Apache Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cwiki.apache.org openwall.com
Oct 5, 2026Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin.CVE-2026-104713 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap and denying service to other users. No additional setting has to be enabled. Applications that do not use the REST plugin are not affected. This issue affects Apache Struts: from 2.1.8 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0. Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
Product
Apache Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cwiki.apache.org openwall.com
Oct 5, 2026Asymmetric resource consumption (amplification) vulnerability in Apache Struts.CVE-2026-104712 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal (java.math.BigDecimal) property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude larger than the request, allowing an unauthenticated remote attacker to exhaust server CPU and outbound network capacity with sustained low-volume traffic. Applications that do not bind request parameters to BigDecimal properties, or never render such a property through the Struts tag library, are not affected. This issue affects Apache Struts: from 2.5.14 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0. Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
Product
Apache Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cwiki.apache.org openwall.com
Oct 5, 2026Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts.CVE-2026-104711 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Struts 7 is affected only when the OGNL allowlist is disabled; it is enabled by default. Applications using the default action mapper, the restful2 mapper, or the Struts REST plugin are not affected. This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0. Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
Product
Apache Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cwiki.apache.org openwall.com
Aug 15, 2026Allocation of resources without limits or throttling vulnerability in Apache Struts.CVE-2026-73635 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches to grow without bound and exhaust the Java heap, denying service to other users. Applications that configure a fixed locale are not affected. This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1. Users are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue.
Product
Apache Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cwiki.apache.org
Aug 15, 2026Uncontrolled resource consumption vulnerability in Apache Struts.CVE-2026-73634 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Uncontrolled resource consumption vulnerability in Apache Struts. An application that exposes an endpoint collecting Content Security Policy violation reports reads the submitted report into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. Such endpoints are ordinarily reachable without authentication. The core distribution maps no such endpoint by default; applications that do not collect violation reports are not affected. This issue affects Apache Struts: from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1. Users are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue.
Product
Apache Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cwiki.apache.org
Aug 15, 2026Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts.CVE-2026-73632 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 4.3
Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the JSON interceptor is affected, which is not enabled by default; applications using the json result type are not affected. This issue affects Apache Struts: 7.2.1. Users are recommended to upgrade to version 7.3.0, which fixes the issue.
Product
Apache Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cwiki.apache.org
Aug 15, 2026Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts.CVE-2026-73631 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 4.3
Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-request parsing state could be shared across concurrent requests, allowing data associated with one request to become observable in another, and configured parsing limits not to be enforced as intended. Populating actions from a JSON request body is not enabled by default; applications that do not use the JSON plugin are not affected. This issue affects Apache Struts: 7.2.1. Users are recommended to upgrade to version 7.3.0, which fixes the issue.
Product
Apache Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cwiki.apache.org
Aug 14, 2026Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts.CVE-2026-73633 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an application is configured to populate actions from a JSON request body, the plugin reads that body into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. The plugin's configurable JSON input length limit does not bound this read. The JSON plugin is an optional component; applications that do not use it, or use it without enabling JSON request-body handling, are not affected. This issue affects Apache Struts: from 2.1.8 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1. Users are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue.
Product
Apache Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cwiki.apache.org
Jan 11, 2026Missing XML Validation vulnerability in Apache Struts, Apache Struts.CVE-2025-68493 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.1
Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes the issue.
Product
Apache Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cwiki.apache.org openwall.com
Dec 10, 2025Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.CVE-2025-66675 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.2
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3. Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue. It's related to https://cve.org/CVERecord?id=CVE-2025-64775 - this CVE addresses missing affected version 6.7.4
Product
Apache Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cve.org cwiki.apache.org
Dec 1, 2025Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.CVE-2025-64775 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0.0 through 6.7.0, from 7.0.0 through 7.0.3. Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.
Product
Apache Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cwiki.apache.org openwall.com
Oct 14, 2025ZTE's ZXCDN product is affected by a Struts remote code execution (RCE) vulnerability.CVE-2025-46581 · Other software · ZTE · reported by psirt@zte.com.cnCritical 9.8
ZTE's ZXCDN product is affected by a Struts remote code execution (RCE) vulnerability. An unauthenticated attacker can remotely execute commands with non-root privileges.
Product
ZXCDN
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.zte.com.cn
Jul 30, 2025** UNSUPPORTED WHEN ASSIGNED ** Improper Output Neutralization for Logs vulnerability in Apache Struts.CVE-2025-54656 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
** UNSUPPORTED WHEN ASSIGNED ** Improper Output Neutralization for Logs vulnerability in Apache Struts. This issue affects Apache Struts Extras: before 2. When using LookupDispatchAction, in some cases, Struts may print untrusted input to the logs without any filtering. Specially-crafted input may lead to log output where part of the message masquerades as a separate log line, confusing consumers of the logs (either human or automated). As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Product
Apache Struts Extras
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Dec 11, 2024File upload logic in Apache Struts is flawed.CVE-2024-53677 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.5
File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . If you are not using an old file upload logic based on FileuploadInterceptor your application is safe. You can find more details in https://cwiki.apache.org/confluence/display/WW/S2-067
Product
Apache Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cwiki.apache.org security.netapp.com
Dec 7, 2023An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be usCVE-2023-50164 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.
Product
Apache Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com lists.apache.org
Dec 5, 2023When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even iCVE-2023-41835 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fixe this issue.
Product
Apache Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Jun 14, 2023Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30,CVE-2023-34396 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 4.3
Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2. Upgrade to Struts 2.5.31 or 6.1.2.1 or greater
Product
Apache Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com cwiki.apache.org
Jun 14, 2023Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30,CVE-2023-34149 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 4.3
Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2. Upgrade to Struts 2.5.31 or 6.1.2.1 or greater.
Product
Apache Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com cwiki.apache.org
Apr 12, 2022The fix issued for CVE-2020-17530 was incomplete.CVE-2021-31805 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.
Product
Apache Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com cwiki.apache.org
Dec 10, 2020Apache Struts Remote Code Execution VulnerabilityCVE-2020-17530 · Websites & servers · Apache · reported by security@apache.orgExploitedCritical 9.8
Forced Object-Graph Navigation Language (OGNL) evaluation in Apache Struts, when evaluated on raw user input in tag attributes, can lead to remote code execution.
Product
Struts
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog jvn.jp packetstormsecurity.com
Sep 14, 2020An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.CVE-2019-0233 · Websites & servers · Apache · reported by security@apache.orgHigh 7.5
An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.
Product
Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cwiki.apache.org launchpad.support.sap.com
Sep 14, 2020Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.CVE-2019-0230 · Websites & servers · Apache · reported by security@apache.orgCritical 9.8
Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
Product
Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Feb 27, 2020Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability.CVE-2015-2992 · Websites & servers · Apache Software Foundation · reported by vultures@jpcert.or.jpMedium 6.1
Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability.
Product
Apache Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Dec 5, 2019A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files.CVE-2012-1592 · Websites & servers · libstruts1.2-java · reported by Red HatHigh 8.8
A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files.
Product
libstruts1.2-java
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com access.redhat.com
Nov 1, 2019Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.CVE-2011-3923 · Websites & servers · Apache · reported by chrome-cve-admin@google.comCritical 9.8
Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.
Product
Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org exploit-db.com
Oct 3, 2019It was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON).CVE-2019-3834 · Websites & servers · RedHat · reported by Red HatHigh 7.3
It was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON). This flaw allows attackers to manipulate ClassLoader properties on a vulnerable server. Exploits that have been published rely on ClassLoader properties that are exposed such as those in JON 3. Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/site/solutions/869353. Note that while multiple products released patches for the original CVE-2014-0114 flaw, the reversion described by this CVE-2019-3834 flaw only occurred in JON 3.
Product
struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com bugzilla.redhat.com
Aug 22, 2018Apache Struts Remote Code Execution VulnerabilityCVE-2018-11776 · Websites & servers · Apache · reported by security@apache.orgExploitedHigh 8.1
Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have no or wildcard namespace. Or, using URL tag which doesn't have value and action set and in same time, its upper package configuration have no or wildcard namespace.
Product
Struts
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com arubanetworks.com
Mar 27, 2018The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted CVE-2018-1327 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here http://struts.apache.org/plugins/rest/#custom-contenttypehandlers. Another option is to implement a custom XML handler based on the Jackson XML handler from the Apache Struts 2.5.16.
Product
Apache Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com securityfocus.com
Dec 13, 2017It was possible for double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags to occur.CVE-2017-14589 · Websites & servers · Atlassian · reported by security@atlassian.comCritical 9.6
It was possible for double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags to occur. An attacker who has restricted administration rights to Bamboo or who hosts a website that a Bamboo administrator visits, is able to exploit this vulnerability to execute Java code of their choice on systems that run a vulnerable version of Bamboo. All versions of Bamboo before 6.1.6 (the fixed version for 6.1.x) and from 6.2.0 before 6.2.5 (the fixed version for 6.2.x) are affected by this vulnerability.
Product
Bamboo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com confluence.atlassian.com
Dec 1, 2017In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious requestCVE-2017-15707 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.2
In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted JSON payload.
Product
Apache Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com oracle.com
Oct 30, 2017The TextParseUtil.translateVariables method in Apache Struts 2.x before 2.3.20 allows remote attackers to execute arbitrary code via a crafted OGNL expression wCVE-2016-3090 · Websites & servers · Apache · reported by Red HatHigh 8.8
The TextParseUtil.translateVariables method in Apache Struts 2.x before 2.3.20 allows remote attackers to execute arbitrary code via a crafted OGNL expression with ANTLR tooling.
Product
Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com security.netapp.com
Oct 16, 2017Apache Struts 2.x before 2.3.29 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation.CVE-2016-4461 · Websites & servers · Apache · reported by Red HatHigh 8.8
Apache Struts 2.x before 2.3.29 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0785.
Product
Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com security.netapp.com
Sep 25, 2017Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20.CVE-2015-5169 · Websites & servers · Apache · reported by Red HatMedium 6.1
Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20.
Product
Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Sep 20, 2017In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is pCVE-2017-9804 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672.
Product
Apache Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record arubanetworks.com oracle.com
Sep 20, 2017The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform aCVE-2017-9793 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted XML payload.
Product
Apache Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record brocade.com oracle.com
Sep 20, 2017In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCVE-2017-12611 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.
Product
Apache Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record arubanetworks.com oracle.com
Sep 20, 2017In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is possible to prepare a sCVE-2016-8738 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.9
In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL.
Product
Apache Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com security.netapp.com
Sep 20, 2017In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will be used for path traveCVE-2016-6795 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will be used for path traversal and execution of arbitrary code on server side.
Product
Apache Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com security.netapp.com
Sep 15, 2017Apache Struts Deserialization of Untrusted Data VulnerabilityCVE-2017-9805 · Websites & servers · Apache · reported by security@apache.orgExploitedHigh 8.1
Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads.
Product
Struts
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com securityfocus.com
Aug 29, 2017Apache Struts 2.x before 2.3.24.1 allows remote attackers to manipulate Struts internals, alter user sessions, or affect container settings via vectors involvinCVE-2015-5209 · Websites & servers · Apache · reported by Red HatHigh 7.5
Apache Struts 2.x before 2.3.24.1 allows remote attackers to manipulate Struts internals, alter user sessions, or affect container settings via vectors involving a top object.
Product
Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Jul 13, 2017When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack.CVE-2017-9787 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack. Solution is to upgrade to Apache Struts version 2.5.12 or 2.3.33.
Product
Apache Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record struts.apache.org oracle.com
Jul 13, 2017If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload CVE-2017-7672 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.9
If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. Solution is to upgrade to Apache Struts version 2.5.12.
Product
Apache Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record struts.apache.org oracle.com
Jul 10, 2017Apache Struts 1 Improper Input Validation VulnerabilityCVE-2017-9791 · Websites & servers · Apache · reported by security@apache.orgExploitedCritical 9.8
The Struts 1 plugin in Apache Struts might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
Product
Struts 1
On CISA’s list since
Feb 10, 2022 (federal fix deadline Aug 10, 2022)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog struts.apache.org oracle.com
Mar 10, 2017Apache Struts Remote Code Execution VulnerabilityCVE-2017-5638 · Websites & servers · Apache · reported by security@apache.orgExploitedRansomwareCritical 9.8
Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution.
Product
Struts
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Apache’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.talosintelligence.com blog.trendmicro.com
Oct 3, 2016Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have unspecified impact via vectors related to improper action name clean up.CVE-2016-4436 · Websites & servers · Apache · reported by Red HatCritical 9.8
Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have unspecified impact via vectors related to improper action name clean up.
Product
Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record www-01.ibm.com www-01.ibm.com
Jul 4, 2016The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value fCVE-2016-4465 · Websites & servers · Apache · reported by Red HatMedium 5.3
The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value for a URL field.
Product
Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Jul 4, 2016The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.CVE-2016-4438 · Websites & servers · Apache · reported by Red HatCritical 9.8
The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.
Product
Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Jul 4, 2016Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.CVE-2016-4433 · Websites & servers · Apache · reported by Red HatHigh 7.5
Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.
Product
Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Jul 4, 2016Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default mCVE-2016-4431 · Websites & servers · Apache · reported by Red HatHigh 7.5
Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method.
Product
Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.