ST
Web Framework
Struts
On CISA KEVExploited in the wildRansomware-linked
99
CVEs
9
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 17High 32Medium 14Low 0
Watch
Add Struts to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-26259 | 6.8 | Dec 16 | XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling Affected: before 6.0.0 |
| CVE-2026-104713 | 6.5 | Oct 5 | Apache Struts: Unbounded request body read in the REST plugin Affected: 2.1.8 through 2.3.37; 2.5.0 through 2.5.33; 6.0.0 through 6.11.0; 7.0.0 through 7.3.0 |
| CVE-2023-34149 | 6.5 | Jun 14 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2 Affected: before 2.5.31; 6.0.0 before 6.1.2.1 |
| CVE-2017-15707 | 6.2 | Dec 1 | In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious request with specially… Affected: 2.5 through 2.5.14 |
| CVE-2015-2992 | 6.1 | Feb 27 | Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability Affected: 2.0.0 before 2.3.20 |
| CVE-2015-5169 | 6.1 | Sep 25 | Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20 Affected: 2.0.0 through 2.3.16.3 |
| CVE-2016-4003 | 6.1 | Apr 12 | Cross-site scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when using a single byte page encoding, allows… Affected: 2.0.0 through 2.3.24.1 |
| CVE-2016-2162 | 6.1 | Apr 12 | Apache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote attackers to conduct cross-site scripting… Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +34 more |
| CVE-2016-8738 | 5.9 | Sep 20 | In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is possible to prepare a special URL which… Affected: 2.5; 2.5.1; 2.5.2; 2.5.3; 2.5.4; 2.5.5 |
| CVE-2017-7672 | 5.9 | Jul 13 | If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when… Affected: 2.5; 2.5.1; 2.5.2; 2.5.5; 2.5.8; 2.5.10; +1 more |
| CVE-2016-4465 | 5.3 | Jul 4 | The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value for a URL field Affected: 2.3.20; 2.3.20.1; 2.3.20.3; 2.3.24; 2.3.24.1; 2.3.24.3; +6 more |
| CVE-2016-3093 | 5.3 | Jun 7 | Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block… Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +34 more |
| CVE-2026-73632 | 4.3 | Aug 15 | Apache Struts: Shared serialization state in the JSON plugin Affected: 7.2.1 |
| CVE-2026-73631 | 4.3 | Aug 15 | Apache Struts: Shared parsing state in the JSON plugin Affected: 7.2.1 |
Showing 14