| CVE-2026-104714 |
Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache…
|
Not rated
|
Oct 5, 2026 |
| CVE-2026-104713 |
Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin
|
Not rated
|
Oct 5, 2026 |
| CVE-2026-104712 |
Asymmetric resource consumption (amplification) vulnerability in Apache Struts
|
Not rated
|
Oct 5, 2026 |
| CVE-2026-104711 |
Improper neutralization of special elements used in an expression language statement ('Expression Language Injection')…
|
Not rated
|
Oct 5, 2026 |
| CVE-2026-73632 |
Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts
|
Not rated
|
Aug 15, 2026 |
| CVE-2026-73631 |
Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts
|
Not rated
|
Aug 15, 2026 |
| CVE-2026-73635 |
Allocation of resources without limits or throttling vulnerability in Apache Struts
|
Not rated
|
Aug 15, 2026 |
| CVE-2026-73634 |
Uncontrolled resource consumption vulnerability in Apache Struts
|
Not rated
|
Aug 15, 2026 |
| CVE-2026-73633 |
Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts
|
Not rated
|
Aug 14, 2026 |
| CVE-2025-68493 |
Missing XML Validation vulnerability in Apache Struts, Apache Struts
|
Not rated
|
Jan 11, 2026 |
| CVE-2025-66675 |
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion
|
Not rated
|
Dec 10, 2025 |
| CVE-2025-64775 |
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion
|
Not rated
|
Dec 1, 2025 |
| CVE-2024-53677 |
Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks
|
9.5
Critical
|
Dec 11, 2024 |
| CVE-2023-50164 |
An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to…
|
Not rated
|
Dec 7, 2023 |
| CVE-2023-41835 |
When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will…
|
Not rated
|
Dec 5, 2023 |
| CVE-2023-34396 |
Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This…
|
4.3
Medium
|
Jun 14, 2023 |
| CVE-2023-34149 |
Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This…
|
4.3
Medium
|
Jun 14, 2023 |
| CVE-2021-31805 |
The fix issued for CVE-2020-17530 was incomplete
|
Not rated
|
Apr 12, 2022 |
| CVE-2020-17530 |
Exploited
Apache Struts Remote Code Execution Vulnerability
|
9.8
Critical
|
Dec 11, 2020 |
| CVE-2015-2992 |
Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability
|
Not rated
|
Feb 27, 2020 |
| CVE-2018-11776 |
Exploited
Apache Struts Remote Code Execution Vulnerability
|
8.1
High
|
Aug 22, 2018 |
| CVE-2018-1327 |
The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a…
|
Not rated
|
Mar 27, 2018 |
| CVE-2017-15707 |
In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow…
|
Not rated
|
Dec 1, 2017 |
| CVE-2017-9804 |
In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field…
|
Not rated
|
Sep 20, 2017 |
| CVE-2017-9793 |
The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library…
|
Not rated
|
Sep 20, 2017 |