CVE-2026-104713 Apache Struts: Unbounded request body read in the REST plugin

Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap a...

CVE-2026-104713

The Apache Struts framework is vulnerable to an allocation of resources without limits or throttling (CWE-770) within the REST plugin . The root cause is that a request body is read into memory without any size bounds, allowing a single request to exhaust the Java heap and cause a denial of servi...

com.amazonaws.serverless:aws-serverless-java-container-struts (>=1.9, <=1.9.5), com.jgeppert.struts2.bootstrap:struts2-bootstrap-plugin (>=4.0.2, <=5.0.6) +79 more potentially affected by CVE-2026-104712 via org.apache.struts:struts2-core (>=6.0.0, <=6.11.0)

org.apache.struts:struts2-core MAVEN version =6.0.0, =1.9, =4.0.2, =4.0.2, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =1.4.0, =1.4.1, =1.4.0, =1.4.3 and more Source cves: CVE-2026-104712 Source advisory: MEND:CVE-2...

com.jgeppert.struts2.bootstrap:struts2-bootstrap-plugin (>=6.0.0, <=6.2.0), com.jgeppert.struts2.bootstrap:struts2-bootstrap-showcase (>=6.0.0, <=6.1.0) +55 more potentially affected by CVE-2026-104712 via org.apache.struts:struts2-core (>=7.0.0, <=7.3.0)

org.apache.struts:struts2-core MAVEN version =7.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =1.0, =7.0.0, =7.0.0, =7.0.0, =7.3.0 and more Source cves: CVE-2026-104712 Source advisory: MEND:CVE-2026-104712...

com.jgeppert.struts2.bootstrap:struts2-bootstrap-plugin (>=6.0.0, <=6.2.0), com.jgeppert.struts2.bootstrap:struts2-bootstrap-showcase (>=6.0.0, <=6.1.0) +55 more potentially affected by CVE-2026-104711 via org.apache.struts:struts2-core (>=7.0.0, <=7.3.0)

org.apache.struts:struts2-core MAVEN version =7.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =1.0, =7.0.0, =7.0.0, =7.0.0, =7.3.0 and more Source cves: CVE-2026-104711 Source advisory: MEND:CVE-2026-104711...

com.amazonaws.serverless:aws-serverless-java-container-struts (>=1.9, <=1.9.5), com.jgeppert.struts2.bootstrap:struts2-bootstrap-plugin (>=4.0.2, <=5.0.6) +79 more potentially affected by CVE-2026-104711 via org.apache.struts:struts2-core (>=6.0.0, <=6.11.0)

org.apache.struts:struts2-core MAVEN version =6.0.0, =1.9, =4.0.2, =4.0.2, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =1.4.0, =1.4.1, =1.4.0, =1.4.3 and more Source cves: CVE-2026-104711 Source advisory: MEND:CVE-2...

WordPress Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin Post SMTP versions = 4.0.1...

WordPress GDPR Framework By Data443 plugin <= 2.5.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by LevinityCyber in WordPress Plugin GDPR Framework By Data443 versions = 2.5.0...

WordPress Front End PM plugin <= 11.4.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Front End PM versions = 11.4.6...

WordPress Simple JWT Login plugin 4.0.0 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Taylsec in WordPress Plugin Simple JWT Login versions 4.0.0...

WordPress Security & Malware scan by CleanTalk plugin <= 2.189 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Security & Malware scan by CleanTalk versions = 2.189...

WordPress WP Migration Plugin DB & Files – WP Synchro plugin <= 1.16.1 - 2FA Bypass vulnerability

2FA Bypass vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Migration Plugin DB & Files – WP Synchro versions = 1.16.1...

Security Bulletin: IBM Security QRadar Log Management AQL Plugin contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. IBM Security QRadar Log Management AQL Plugin has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-76905 DESCRIPTION: kin-opena...

CVE-2026-105397 LearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Quiz Question Hint and Explanation

LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the updatequestion...

EUVD-2026-92444

LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the updatequestion...

WordPress Builderius plugin <= 1.4-beta - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Jitlada in WordPress Plugin Builderius versions = 1.4-beta...

VMware vCenter VSAN RCE (CVE-2021-21985)

Exploits CVE-2021-21985 in VMware vCenter: unauthenticated RCE via the VSAN Health Check plugin JSON API Virtual SAN Health Check. !/usr/bin/env python3 -- coding: utf-8 -- """VMware vCenter VSAN Health Check RCE CVE-2021-21985.""" import re from kittysploit import from...

LiteSpeed cPanel Plugin CVE-2026-48172 Detection

Detects LiteSpeed Web Server cPanel plugin endpoints that may be vulnerable to CVE-2026-48172 Redis enable/disable privesc to root. !/usr/bin/env python3 -- coding: utf-8 -- """Detect LiteSpeed cPanel plugin privesc surface CVE-2026-48172.""" from kittysploit import from...

LiteSpeed cPanel Plugin Privesc RCE (CVE-2026-48172)

Exploits CVE-2026-48172 in the LiteSpeed cPanel plugin: mishandled Redis enable/disable API allows privilege escalation and arbitrary command execution as root via crafted cpaneljsonapi requests. !/usr/bin/env python3 -- coding: utf-8 -- """LiteSpeed cPanel plugin privesc to RCE CVE-2026-48172.""...

WordPress HTTP Requests Manager plugin <= 1.3.11 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dodoh4t in WordPress Plugin HTTP Requests Manager versions = 1.3.11...