apache struts

Name: apache struts
Brand: apache

productUS

cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

16critical37high35medium1low

updated 2026-10-27

vulnerabilities (99)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2017-5638US	critical9.8OT critical	100.0% (100th)	KEV	2.5.10.1	2017-03-11	2 versions
CVE-2013-2251US	critical9.8OT critical	100.0% (100th)	KEV	no fix	2013-07-20	2.0.0 → 2.3.15
CVE-2018-11776US	high8.1OT critical	100.0% (100th)	KEV	2.5.17	2018-08-22	2 versions
CVE-2017-9805US	high8.1OT critical	99.4% (100th)	KEV	2.3.34	2017-09-15	2 versions
CVE-2017-9791US	critical9.8OT critical	98.9% (100th)	KEV	no fix	2017-07-10	33 versions
CVE-2016-3081US	high8.1OT critical	96.5% (100th)	KEV	2.3.28.1	2016-04-26	3 versions
CVE-2020-17530US	critical9.8OT critical	96.3% (100th)	KEV	2.5.30	2020-12-11	2.0.0 → 2.5.30
CVE-2012-0391US	critical9.8OT critical	75.6% (100th)	KEV	2.2.3.1	2012-01-08	< 2.2.3.1
CVE-2006-1547US	high7.5OT critical	54.6% (99th)	KEV	1.2.9	2006-03-30	< 1.2.9
CVE-2014-0094US	medium5.0	99.4% (100th)	Exploit	2.3.16.1	2014-03-11	2.0.0 → 2.3.16.1
CVE-2014-0114US	high7.5	99.0% (100th)	Exploit	no fix	2014-04-30	12 versions
CVE-2014-0112US	high7.5	98.1% (100th)	Exploit	2.3.16.2	2014-04-29	2.0.0 → 2.3.16.2
CVE-2012-0392US	medium6.8	97.5% (100th)	Exploit	2.3.1	2012-01-08	2.0.0 → 2.3.1
CVE-2019-0230US	critical9.8	96.9% (100th)	Exploit	no fix	2020-09-14	2.0.0 → 2.5.20
CVE-2013-2248US	medium5.8	94.7% (100th)	Exploit	no fix	2013-07-20	44 versions
CVE-2013-1965US	high9.3	93.5% (100th)	Exploit	2.3.14.1	2013-07-10	2.0.0 → 2.3.14.1
CVE-2010-1870US	medium5.0	92.0% (100th)	Exploit	no fix	2010-08-17	26 versions
CVE-2011-3923US	critical9.8	89.5% (100th)	Exploit	2.3.1.2	2019-11-01	2.0.0 → 2.3.1.2
CVE-2017-12611US	critical9.8	87.1% (100th)	Exploit	no fix	2017-09-20	87 versions
CVE-2021-31805US	critical9.8	85.4% (100th)	Exploit	no fix	2022-04-12	2.0.0 → 2.5.29
CVE-2020-26259US	medium6.8	82.4% (100th)	Exploit	6.0.0	2020-12-16	< 6.0.0
CVE-2016-3087US	critical9.8	81.9% (100th)	Exploit	no fix	2016-06-07	5 versions
CVE-2020-26258US	high7.7	81.8% (100th)	Exploit	6.0.0	2020-12-16	< 6.0.0
CVE-2023-50164US	critical9.8	80.8% (100th)	Exploit	2.5.33	2023-12-07	2 versions
CVE-2014-0113US	high7.5	78.3% (100th)	Exploit	2.3.16.2	2014-04-29	2.0.0 → 2.3.16.2
CVE-2013-2115US	high8.1	74.6% (99th)	Exploit	no fix	2013-07-10	2.0.0 → 2.3.14.1
CVE-2013-1966US	high9.3	73.7% (99th)	Exploit	2.3.14.1	2013-07-10	2.0.0 → 2.3.14.1
CVE-2012-0394US	medium6.8	72.9% (99th)	Exploit	no fix	2012-01-08	2.0.0 → 2.3.17
CVE-2008-6505US	medium5.0	72.7% (99th)	Exploit	no fix	2009-03-23	7 versions
CVE-2024-53677US	critical9.8	72.4% (99th)	Exploit	6.4.0	2024-12-11	2 versions
CVE-2013-2134US	high9.3	70.2% (99th)	Exploit	2.3.14.3	2013-07-16	2.0.0 → 2.3.14.3
CVE-2012-1006US	medium4.3	56.6% (99th)	Exploit	no fix	2012-02-07	2 versions
CVE-2025-68493US	high8.1	50.4% (99th)	Exploit	6.1.1	2026-01-11	3 versions
CVE-2008-6504US	medium5.0	36.6% (98th)	Exploit	no fix	2009-03-23	12 versions
CVE-2012-0393US	medium6.4	36.3% (98th)	Exploit	2.3.1.1	2012-01-08	2.1.0 → 2.3.1.1
CVE-2011-1772US	low2.6	33.3% (98th)	Exploit	no fix	2011-05-13	28 versions
CVE-2012-1007US	medium4.3	32.8% (98th)	Exploit	no fix	2012-02-07	= 1.3.10
CVE-2012-1592US	high8.8	28.5% (98th)	Exploit	no fix	2019-12-05	= 2.0.0
CVE-2011-5057US	medium5.0	27.2% (98th)	Exploit	2.3.3	2012-01-08	2.0.0 → 2.3.3
CVE-2005-3745US	medium4.3	25.7% (98th)	Exploit	no fix	2005-11-22	= 1.2.7
CVE-2016-4438US	critical9.8	16.7% (97th)	Exploit	no fix	2016-07-04	7 versions
CVE-2026-104711US	—	1.39% (72nd)	Exploit	6.12.0	2026-10-05	4 versions
CVE-2026-73633US	—	0.70% (53rd)	Exploit	7.3.0	2026-08-14	4 versions
CVE-2019-0233US	high7.5	66.1% (99th)	—	no fix	2020-09-14	2.0.0 → 2.5.20
CVE-2016-1182US	high8.2	25.7% (98th)	—	no fix	2016-07-04	20 versions
CVE-2015-0899US	high7.5	21.3% (98th)	—	no fix	2016-07-04	12 versions
CVE-2016-3082US	critical9.8	19.2% (97th)	—	no fix	2016-04-26	56 versions
CVE-2013-2135US	high9.3	13.8% (97th)	—	2.3.14.3	2013-07-16	2.0.0 → 2.3.14.3
CVE-2012-0838US	high10.0	13.7% (96th)	—	no fix	2012-03-02	2.0.0 → 2.2.3
CVE-2016-1181US	high8.1	12.7% (96th)	—	no fix	2016-07-04	20 versions

showing 50 of 99

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-20Improper Input Validation34 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')15 CVEs
CWE-94Improper Control of Generation of Code ('Code Injection')11 CVEs
CWE-264CWE-2649 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')4 CVEs
CWE-770Allocation of Resources Without Limits or Throttling4 CVEs
CWE-352Cross-Site Request Forgery (CSRF)3 CVEs
CWE-400Uncontrolled Resource Consumption3 CVEs

sources (2)

Which sources assert this record, and when.

USNVD / CVE99 CVEs
NLNCSC-NL (CSAF)1 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan