Maven org.apache.struts:struts2-core
productUSpkg:maven/org.apache.struts/struts2-core
A product tracked in the threat graph; the vulnerabilities below are known to affect it.
by severity
14critical22high21medium1low
updated 2026-10-27
| ID | severity CVSS base severity and score (0–10). | EPSS FIRST.org probability this is exploited in the next 30 days, with its percentile rank among all CVEs. | exploitable On CISA's Known Exploited Vulnerabilities list, or a public exploit is on file. | patched Whether a fixed version is on file for an affecting range. | published | affected |
|---|
| CVE-2017-5638US | critical9.8OT critical | 100.0% (100th) | KEV | ✓2.3.32 | 2017-03-11 | 2 versions |
| CVE-2013-2251US | critical9.8OT critical | 100.0% (100th) | KEV | ✓2.3.15.1 | 2013-07-20 | < 2.3.15.1 |
| CVE-2018-11776US | high8.1OT critical | 100.0% (100th) | KEV | ✓2.3.35 | 2018-08-22 | 2 versions |
| CVE-2016-3081US | high8.1OT critical | 96.5% (100th) | KEV | ✓2.3.20.3 | 2016-04-26 | 3 versions |
| CVE-2020-17530US | critical9.8OT critical | 96.3% (100th) | KEV | ✓2.5.26 | 2020-12-11 | 2.0.0 → 2.5.26 |
| CVE-2012-0391US | critical9.8OT critical | 75.6% (100th) | KEV | ✓2.2.3.1 | 2012-01-08 | < 2.2.3.1 |
| CVE-2014-0094US | medium5.0 | 99.4% (100th) | Exploit | ✓2.3.16.2 | 2014-03-11 | 2.0.0 → 2.3.16.2 |
| CVE-2014-0112US | high7.5 | 98.1% (100th) | Exploit | ✓2.3.20 | 2014-04-29 | < 2.3.20 |
| CVE-2012-0392US | medium6.8 | 97.5% (100th) | Exploit | ✓2.2.3.1 | 2012-01-08 | < 2.2.3.1 |
| CVE-2019-0230US | critical9.8 | 96.9% (100th) | Exploit | ✓2.5.22 | 2020-09-14 | 2.0.0 → 2.5.22 |
| CVE-2013-2248US | medium5.8 | 94.7% (100th) | Exploit | ✓2.3.15.1 | 2013-07-20 | < 2.3.15.1 |
| CVE-2013-1965US | high9.3 | 93.5% (100th) | Exploit | ✓2.3.14.3 | 2013-07-10 | < 2.3.14.3 |
| CVE-2010-1870US | medium5.0 | 92.0% (100th) | Exploit | ✓2.2.1 | 2010-08-17 | < 2.2.1 |
| CVE-2011-3923US | critical9.8 | 89.5% (100th) | Exploit | ✓2.3.1.2 | 2019-11-01 | 2.0.0 → 2.3.1.2 |
| CVE-2017-12611US | critical9.8 | 87.1% (100th) | Exploit | ✓2.5.11 | 2017-09-20 | 2 versions |
| CVE-2021-31805US | critical9.8 | 85.4% (100th) | Exploit | ✓2.5.30 | 2022-04-12 | 2.0.0 → 2.5.30 |
| CVE-2016-3087US | critical9.8 | 81.9% (100th) | Exploit | ✓2.3.20.3 | 2016-06-07 | 3 versions |
| CVE-2023-50164US | critical9.8 | 80.8% (100th) | Exploit | ✓2.5.33 | 2023-12-07 | 2 versions |
| CVE-2014-0113US | high7.5 | 78.3% (100th) | Exploit | ✓2.3.20 | 2014-04-29 | < 2.3.20 |
| CVE-2013-2115US | high8.1 | 74.6% (99th) | Exploit | ✓2.3.14.2 | 2013-07-10 | 2.0.0 → 2.3.14.2 |
| CVE-2013-1966US | high9.3 | 73.7% (99th) | Exploit | ✓2.3.14.2 | 2013-07-10 | 2.0.0 → 2.3.14.2 |
| CVE-2008-6505US | medium5.0 | 72.7% (99th) | Exploit | ✓2.0.12 | 2009-03-23 | 2 versions |
| CVE-2024-53677US | critical9.8 | 72.4% (99th) | Exploit | ✓6.4.0 | 2024-12-11 | < 6.4.0 |
| CVE-2013-2134US | high9.3 | 70.2% (99th) | Exploit | ✓2.3.14.3 | 2013-07-16 | 2.0.0 → 2.3.14.3 |
| CVE-2025-68493US | high8.1 | 50.4% (99th) | Exploit | ✓6.1.1 | 2026-01-11 | 3 versions |
| CVE-2012-0393US | medium6.4 | 36.3% (98th) | Exploit | ✓2.3.1.1 | 2012-01-08 | < 2.3.1.1 |
| CVE-2011-1772US | low2.6 | 33.3% (98th) | Exploit | ✓2.2.3 | 2011-05-13 | < 2.2.3 |
| CVE-2012-1592US | high8.8 | 28.5% (98th) | Exploit | ✓2.5.22 | 2019-12-05 | 2.0 → 2.5.22 |
| CVE-2016-4438US | critical9.8 | 16.7% (97th) | Exploit | ✓2.3.29 | 2016-07-04 | 2.3.19 → 2.3.29 |
| CVE-2019-0233US | high7.5 | 66.1% (99th) | — | ✓2.5.22 | 2020-09-14 | 2.0.0 → 2.5.22 |
| CVE-2016-3082US | critical9.8 | 19.2% (97th) | — | ✓2.3.20.3 | 2016-04-26 | 3 versions |
| CVE-2013-2135US | high9.3 | 13.8% (97th) | — | ✓2.3.14.3 | 2013-07-16 | 2.0.0 → 2.3.14.3 |
| CVE-2012-0838US | high10.0 | 13.7% (96th) | — | ✓2.2.3.1 | 2012-03-02 | < 2.2.3.1 |
| CVE-2016-4003US | medium6.1 | 11.6% (96th) | — | ✓2.3.28 | 2016-04-12 | 2.0.0 → 2.3.28 |
| CVE-2017-9787US | high7.5 | 10.6% (96th) | — | ✓2.3.33 | 2017-07-13 | 2 versions |
| CVE-2016-4465US | medium5.3 | 10.4% (96th) | — | ✓2.3.29 | 2016-07-04 | 2 versions |
| CVE-2017-7672US | medium5.9 | 9.84% (96th) | — | ✓2.5.12 | 2017-07-13 | 2.5.0 → 2.5.12 |
| CVE-2015-5209US | high7.5 | 9.06% (95th) | — | ✓2.3.24.1 | 2017-08-29 | < 2.3.24.1 |
| CVE-2016-0785US | high8.8 | 8.88% (95th) | — | ✓2.3.20.3 | 2016-04-12 | 2 versions |
| CVE-2016-3093US | medium5.3 | 8.44% (95th) | — | ✓2.3.24.3 | 2016-06-07 | 2.0.0 → 2.3.24.3 |
| CVE-2013-4316US | high10.0 | 8.40% (95th) | — | ✓2.3.15.2 | 2013-09-30 | 2.0.0 → 2.3.15.2 |
| CVE-2017-9804US | high7.5 | 8.24% (95th) | — | ✓2.5.13 | 2017-09-20 | 2 versions |
| CVE-2016-4461US | high8.8 | 8.09% (95th) | — | ✓2.3.29 | 2017-10-16 | 2.0.0 → 2.3.29 |
| CVE-2016-2162US | medium6.1 | 7.78% (95th) | — | ✓2.3.28 | 2016-04-12 | 2.0.0 → 2.3.28 |
| CVE-2015-5169US | medium6.1 | 7.53% (94th) | — | ✓2.3.20 | 2017-09-25 | < 2.3.20 |
| CVE-2023-41835US | high7.5 | 7.30% (94th) | — | ✓6.1.2.2 | 2023-12-05 | 3 versions |
| CVE-2016-4436US | critical9.8 | 6.60% (94th) | — | ✓2.3.29 | 2016-10-03 | 2 versions |
| CVE-2014-0116US | medium5.8 | 6.57% (94th) | — | ✓2.3.20 | 2014-05-08 | < 2.3.20 |
| CVE-2013-4310US | medium5.8 | 6.52% (94th) | — | ✓2.3.15.3 | 2013-09-30 | < 2.3.15.3 |
| CVE-2015-1831US | high7.5 | 6.32% (94th) | — | ✓2.3.20.1 | 2015-07-16 | 2.0.0 → 2.3.20.1 |
showing 50 of 60