# org.apache.struts:struts2-core (Maven) vulnerabilities Source: https://junglewise.ai/threats/technologies/org-apache-struts-struts2-core Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/org-apache-struts-struts2-core.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 60 vulnerabilities in org.apache.struts:struts2-core (Maven): 0 in the last 7 days and 0 in the last 90 days, 6 of them critical and 6 exploited in the wild. The most recent, CVE-2025-68493, was published on 11 January 2026. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 60 (6 critical, 6 exploited in the wild) ## About org.apache.struts:struts2-core (Maven) Java web framework for building MVC-based applications with built-in security features. ## Latest org.apache.struts:struts2-core (Maven) vulnerabilities - [CVE-2025-68493: Apache Struts XXE injection in XWork component](https://junglewise.ai/threats/cve-2025-68493-apache-struts-xxe-injection-in-xwork-component) (high, CVSS 8.1, published 11 Jan 2026) - [CVE-2025-66675: Apache Struts has a Denial of Service vulnerability](https://junglewise.ai/threats/cve-2025-66675-apache-struts-has-a-denial-of-service-vulnerability) (high, CVSS 8.2, published 10 Dec 2025) - [CVE-2025-64775: Apache Struts is Vulnerable to DoS via File Leak](https://junglewise.ai/threats/cve-2025-64775-apache-struts-is-vulnerable-to-dos-via-file-leak) (high, CVSS 7.5, published 1 Dec 2025) - [CVE-2024-53677: Apache Struts file upload logic is flawed](https://junglewise.ai/threats/cve-2024-53677-apache-struts-file-upload-logic-is-flawed) (low, CVSS 3.1, published 11 Dec 2024) - [CVE-2023-50164: Apache Struts vulnerable to path traversal](https://junglewise.ai/threats/cve-2023-50164-apache-struts-vulnerable-to-path-traversal) (low, CVSS 3.1, published 7 Dec 2023) - [CVE-2023-41835: Apache Struts Improper Control of Dynamically-Managed Code Resources vulnerability](https://junglewise.ai/threats/cve-2023-41835-apache-struts-improper-control-of-dynamically-managed-code) (low, CVSS 3.1, published 5 Dec 2023) - [CVE-2023-34396: Apache Struts vulnerable to memory exhaustion](https://junglewise.ai/threats/cve-2023-34396-apache-struts-vulnerable-to-memory-exhaustion) (low, CVSS 3.1, published 14 Jun 2023) - [CVE-2023-34149: Apache Struts vulnerable to memory exhaustion](https://junglewise.ai/threats/cve-2023-34149-apache-struts-vulnerable-to-memory-exhaustion) (low, CVSS 3.1, published 14 Jun 2023) - [CVE-2019-0233: Improper Preservation of Permissions in Apache Struts](https://junglewise.ai/threats/cve-2019-0233-improper-preservation-of-permissions-in-apache-struts) (low, CVSS 3.1, published 24 May 2022) - [CVE-2015-2992: Cross-site Scripting in Apache Struts](https://junglewise.ai/threats/cve-2015-2992-cross-site-scripting-in-apache-struts) (info, published 24 May 2022) - [CVE-2008-6682: Apache Struts is vulnerable to Cross-site Scripting](https://junglewise.ai/threats/cve-2008-6682-apache-struts-is-vulnerable-to-cross-site-scripting) (info, published 17 May 2022) - [CVE-2008-6505: Apache Struts directory traversal vulnerability](https://junglewise.ai/threats/cve-2008-6505-apache-struts-directory-traversal-vulnerability) (info, published 17 May 2022) - [CVE-2011-1772: Cross-site Scripting in Apache Struts](https://junglewise.ai/threats/cve-2011-1772-cross-site-scripting-in-apache-struts) (info, published 17 May 2022) - [CVE-2013-6348: Apache Struts is vulnerable to Cross-site Scripting](https://junglewise.ai/threats/cve-2013-6348-apache-struts-is-vulnerable-to-cross-site-scripting) (info, published 17 May 2022) - [CVE-2013-4310: Apache Struts2 Broken Access Control Vulnerability](https://junglewise.ai/threats/cve-2013-4310-apache-struts2-broken-access-control-vulnerability) (info, published 17 May 2022) - [CVE-2016-2162: Apache Struts XSS Vulnerability](https://junglewise.ai/threats/cve-2016-2162-apache-struts-xss-vulnerability) (low, CVSS 3, published 17 May 2022) - [CVE-2016-3093: Denial of service in Apache Struts](https://junglewise.ai/threats/cve-2016-3093-denial-of-service-in-apache-struts) (low, CVSS 3, published 17 May 2022) - [CVE-2016-3082: Remote Code Execution in Apache Struts](https://junglewise.ai/threats/cve-2016-3082-remote-code-execution-in-apache-struts) (low, CVSS 3, published 17 May 2022) - [CVE-2013-4316: Code injection in Apache Struts](https://junglewise.ai/threats/cve-2013-4316-code-injection-in-apache-struts) (info, published 17 May 2022) - [CVE-2013-2248: Open redirect in Apache Struts](https://junglewise.ai/threats/cve-2013-2248-open-redirect-in-apache-struts) (info, published 17 May 2022) - [CVE-2016-4436: Apache Struts improper action name cleanup](https://junglewise.ai/threats/cve-2016-4436-apache-struts-improper-action-name-cleanup) (low, CVSS 3, published 17 May 2022) - [CVE-2016-4465: Apache Struts vulnerable to possible DoS attack when using URLValidator](https://junglewise.ai/threats/cve-2016-4465-apache-struts-vulnerable-to-possible-dos-attack-when-using) (low, CVSS 3, published 17 May 2022) - [CVE-2012-4386: Cross-Site Request Forgery in Apache Struts](https://junglewise.ai/threats/cve-2012-4386-cross-site-request-forgery-in-apache-struts) (info, published 17 May 2022) - [CVE-2015-1831: Incomplete exclude pattern in Apache Struts](https://junglewise.ai/threats/cve-2015-1831-incomplete-exclude-pattern-in-apache-struts) (info, published 17 May 2022) - [CVE-2015-5209: Special top object can be used to access Struts' internals](https://junglewise.ai/threats/cve-2015-5209-special-top-object-can-be-used-to-access-struts-internals) (low, CVSS 3, published 14 May 2022) ## Most severe org.apache.struts:struts2-core (Maven) vulnerabilities - [CVE-2012-0391: Apache Struts Remote Java Code Execution](https://junglewise.ai/threats/cve-2012-0391-apache-struts-2-improper-input-validation-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 4 May 2022) - [CVE-2013-2251: Code injection in Apache Struts](https://junglewise.ai/threats/cve-2013-2251-apache-struts-improper-input-validation-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 13 May 2022) - [CVE-2020-17530: Remote code execution in Apache Struts](https://junglewise.ai/threats/cve-2020-17530-apache-struts-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 9 Feb 2022) - [CVE-2017-5638: Apache Struts vulnerable to remote arbitrary command execution due to improper input validation](https://junglewise.ai/threats/cve-2017-5638-apache-struts-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 3, published 18 Oct 2018) - [CVE-2018-11776: Apache Struts vulnerable to remote command execution (RCE) due to improper input validation](https://junglewise.ai/threats/cve-2018-11776-apache-struts-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 3, published 18 Oct 2018) - [CVE-2016-3081: Apache Struts command injection in Dynamic Method Invocation](https://junglewise.ai/threats/cve-2016-3081-apache-struts-rce-vulnerability) (critical, exploited in the wild, CVSS 3, published 14 May 2022) - [CVE-2025-66675: Apache Struts has a Denial of Service vulnerability](https://junglewise.ai/threats/cve-2025-66675-apache-struts-has-a-denial-of-service-vulnerability) (high, CVSS 8.2, published 10 Dec 2025) - [CVE-2025-68493: Apache Struts XXE injection in XWork component](https://junglewise.ai/threats/cve-2025-68493-apache-struts-xxe-injection-in-xwork-component) (high, CVSS 8.1, published 11 Jan 2026) - [CVE-2025-64775: Apache Struts is Vulnerable to DoS via File Leak](https://junglewise.ai/threats/cve-2025-64775-apache-struts-is-vulnerable-to-dos-via-file-leak) (high, CVSS 7.5, published 1 Dec 2025) - [CVE-2019-0230: Improperly Controlled Modification of Dynamically-Determined Object Attributes in Apache Struts](https://junglewise.ai/threats/cve-2019-0230-improperly-controlled-modification-of-dynamically-determined) (low, CVSS 3.1, published 2 Dec 2021) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Maven technologies - [org.jenkins-ci.main:jenkins-core (Maven)](https://junglewise.ai/threats/technologies/org-jenkins-ci-main-jenkins-core): 259 vulnerabilities - [org.apache.tomcat:tomcat (Maven)](https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat): 169 vulnerabilities - [com.liferay.portal:release.portal.bom (Maven)](https://junglewise.ai/threats/technologies/com-liferay-portal-release-portal-bom): 159 vulnerabilities - [com.liferay.portal:release.dxp.bom (Maven)](https://junglewise.ai/threats/technologies/com-liferay-portal-release-dxp-bom): 125 vulnerabilities - [org.keycloak:keycloak-services (Maven)](https://junglewise.ai/threats/technologies/org-keycloak-keycloak-services): 122 vulnerabilities - [com.fasterxml.jackson.core:jackson-databind (Maven)](https://junglewise.ai/threats/technologies/com-fasterxml-jackson-core-jackson-databind): 86 vulnerabilities - [org.apache.tomcat.embed:tomcat-embed-core (Maven)](https://junglewise.ai/threats/technologies/org-apache-tomcat-embed-tomcat-embed-core): 83 vulnerabilities - [org.keycloak:keycloak-core (Maven)](https://junglewise.ai/threats/technologies/org-keycloak-keycloak-core): 57 vulnerabilities - [org.xwiki.platform:xwiki-platform-oldcore (Maven)](https://junglewise.ai/threats/technologies/org-xwiki-platform-xwiki-platform-oldcore): 46 vulnerabilities - [org.apache.tomcat:tomcat-catalina (Maven)](https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat-catalina): 44 vulnerabilities - [org.elasticsearch:elasticsearch (Maven)](https://junglewise.ai/threats/technologies/org-elasticsearch-elasticsearch): 41 vulnerabilities - [io.undertow:undertow-core (Maven)](https://junglewise.ai/threats/technologies/io-undertow-undertow-core): 40 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "org.apache.struts:struts2-core (Maven) vulnerabilities", https://junglewise.ai/threats/technologies/org-apache-struts-struts2-core, 9 November 2026.