CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 28, 2026, 10:23 AM ET)

What this means for you

This week: 3,193 CVEs published, 239 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,193; Show in the list
Critical, last 7 days: 239; Show in the list
Healthcare-tagged, last 7 days: 8; Show in the list
Known exploited (CISA KEV): 1,760; Show in the list

Showing CVEs that name the product apache:struts. Show all products

26 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2006-1547 Known exploited	High 7.5	ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name… Assigned by redhat	Mar 30, 2006
CVE-2012-0391 Known exploited	Critical 9.8	The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allow… Assigned by mitre	Jan 8, 2012
CVE-2013-2251 Known exploited	Critical 9.8	Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix. Assigned by redhat	Jul 17, 2013
CVE-2014-0114	High 7.5	Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the… Assigned by redhat	Apr 30, 2014
CVE-2016-3081 Known exploited	High 8.1	Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to… Assigned by redhat	Apr 26, 2016
CVE-2016-1182	High 8.2	ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a… Assigned by jpcert	Jul 4, 2016
CVE-2016-1181	High 8.1	ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of servic… Assigned by jpcert	Jul 4, 2016
CVE-2017-5638 Known exploited	Critical 9.8	The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows r… Assigned by apache	Mar 10, 2017
CVE-2017-9791 Known exploited	Critical 9.8	The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage. Assigned by apache	Jul 10, 2017
CVE-2017-9805 Known exploited	High 8.1	The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can… Assigned by apache	Sep 15, 2017

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.