com.jgeppert.struts2.bootstrap:struts2-bootstrap-showcase (6.1.0), com.jgeppert.struts2.jquery:struts2-jquery-grid-showcase (6.1.0) +3 more potentially affected by CVE-2026-73631 via org.apache.struts:struts2-json-plugin (7.2.1)

org.apache.struts:struts2-json-plugin MAVEN version 7.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.struts:struts2-json-plugin and may be impacted: - com.jgeppert.struts2.bootstrap:struts2-bootstrap-showcase 6.1.0 -...

com.amazonaws.serverless:aws-serverless-java-container-struts (>=1.9, <=1.9.5), com.jgeppert.struts2.bootstrap:struts2-bootstrap-plugin (>=4.0.2, <=5.0.6) +79 more potentially affected by CVE-2026-73635 via org.apache.struts:struts2-core (>=6.0.0, <=6.10.0)

org.apache.struts:struts2-core MAVEN version =6.0.0, =1.9, =4.0.2, =4.0.2, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =1.4.0, =1.4.1, =1.4.0, =1.4.3 and more Source cves: CVE-2026-73635 Source advisory: MEND:CVE-202...

com.jgeppert.struts2.bootstrap:struts2-bootstrap-plugin (>=6.0.0, <=6.1.0), com.jgeppert.struts2.bootstrap:struts2-bootstrap-showcase (>=6.0.0, <=6.1.0) +55 more potentially affected by CVE-2026-73635 via org.apache.struts:struts2-core (>=7.0.0, <=7.2.1)

org.apache.struts:struts2-core MAVEN version =7.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =1.0, =7.0.0, =7.0.0, =7.0.0, =7.2.1 and more Source cves: CVE-2026-73635 Source advisory: MEND:CVE-2026-73635...

com.amazonaws.serverless:aws-serverless-java-container-struts (>=1.9, <=1.9.5), com.jgeppert.struts2.bootstrap:struts2-bootstrap-plugin (>=4.0.2, <=5.0.6) +79 more potentially affected by CVE-2026-73634 via org.apache.struts:struts2-core (>=6.0.0, <=6.10.0)

org.apache.struts:struts2-core MAVEN version =6.0.0, =1.9, =4.0.2, =4.0.2, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =1.4.0, =1.4.1, =1.4.0, =1.4.3 and more Source cves: CVE-2026-73634 Source advisory: MEND:CVE-202...

com.jgeppert.struts2.bootstrap:struts2-bootstrap-plugin (>=6.0.0, <=6.1.0), com.jgeppert.struts2.bootstrap:struts2-bootstrap-showcase (>=6.0.0, <=6.1.0) +55 more potentially affected by CVE-2026-73634 via org.apache.struts:struts2-core (>=7.0.0, <=7.2.1)

org.apache.struts:struts2-core MAVEN version =7.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =1.0, =7.0.0, =7.0.0, =7.0.0, =7.2.1 and more Source cves: CVE-2026-73634 Source advisory: MEND:CVE-2026-73634...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the JSON plugin when handling JSON request bodies. An attacker can cause excessive memory consumption by sending a large JSON payload, potentially leading to service disruption for...

com.jgeppert.struts2.bootstrap:struts2-bootstrap-showcase (>=6.0.0, <=6.1.0), com.jgeppert.struts2.jquery:struts2-jquery-grid-showcase (>=6.0.0, <=6.1.0) +4 more potentially affected by CVE-2026-73633 via org.apache.struts:struts2-json-plugin (>=7.0.0, <=7.2.1)

org.apache.struts:struts2-json-plugin MAVEN version =7.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =7.0.0, =7.0.0, =7.2.1 Source cves: CVE-2026-73633 Source advisory: SNYK:JAVA-ORGAPACHESTRUTS-19352508...

com.amazonaws.serverless:aws-serverless-java-container-struts (>=1.9, <=1.9.5), com.jgeppert.struts2.bootstrap:struts2-bootstrap-plugin (>=4.0.2, <=5.0.6) +79 more potentially affected by CVE-2026-73633 via org.apache.struts:struts2-core (>=6.0.0, <=6.10.0)

org.apache.struts:struts2-core MAVEN version =6.0.0, =1.9, =4.0.2, =4.0.2, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =1.4.0, =1.4.1, =1.4.0, =1.4.3 and more Source cves: CVE-2026-73633 Source advisory: SNYK:JAVA-OR...

com.jgeppert.struts2.bootstrap:struts2-bootstrap-plugin (>=6.0.0, <=6.1.0), com.jgeppert.struts2.bootstrap:struts2-bootstrap-showcase (>=6.0.0, <=6.1.0) +55 more potentially affected by CVE-2026-73633 via org.apache.struts:struts2-core (>=7.0.0, <=7.2.1)

org.apache.struts:struts2-core MAVEN version =7.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =1.0, =7.0.0, =7.0.0, =7.0.0, =7.2.1 and more Source cves: CVE-2026-73633 Source advisory:...

com.jgeppert.struts2.bootstrap:struts2-bootstrap-showcase (>=4.0.2, <=5.0.6), com.jgeppert.struts2.jquery:struts2-jquery-grid-showcase (>=5.0.0, <=5.0.7) +4 more potentially affected by CVE-2026-73633 via org.apache.struts:struts2-json-plugin (>=6.0.0, <=6.10.0)

org.apache.struts:struts2-json-plugin MAVEN version =6.0.0, =4.0.2, =5.0.0, =5.0.0, =5.0.0, =6.0.0, =6.0.0, =6.10.0 Source cves: CVE-2026-73633 Source advisory: MEND:CVE-2026-73633...

com.jgeppert.struts2.bootstrap:struts2-bootstrap-showcase (>=6.0.0, <=6.1.0), com.jgeppert.struts2.jquery:struts2-jquery-grid-showcase (>=6.0.0, <=6.1.0) +4 more potentially affected by CVE-2026-73633 via org.apache.struts:struts2-json-plugin (>=7.0.0, <=7.2.1)

org.apache.struts:struts2-json-plugin MAVEN version =7.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =7.0.0, =7.0.0, =7.2.1 Source cves: CVE-2026-73633 Source advisory: MEND:CVE-2026-73633...

Apache Struts2 S2-062 - Remote Code Execution Detection

Apache Struts2 S2-062 is vulnerable to remote code execution. The fix issued for CVE-2020-17530 S2-061 was incomplete, meaning some of the tag's attributes could still perform a double evaluation if a developer applied forced OGNL evaluation by using the %... syntax. !/usr/bin/env python3 --...

Apache Struts2 S2-057 - Remote Code Execution Detection

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible remote code execution when alwaysSelectFullNamespace is true either by user or a plugin like Convention Plugin and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace...

Apache Struts2 S2-008 RCE Detection

The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method. !/usr/bin/env python3 -- coding: utf-8...

Apache Struts2 S2-012 RCE Detection

Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Struts Showcase App...

Apache Struts Detection

Detects Struts2 action extensions and OGNL error fingerprints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Apache Struts2 framework indicators.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse...

com.flowlogix:build-core (>=0.8.6, <=0.9-obsolete), com.flowlogix:flowlogix-services (>=0.8.6, <=0.9-obsolete) +55 more potentially affected by CVE-2026-49268 via org.apache.shiro:shiro-core (1.1.0)

org.apache.shiro:shiro-core MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.shiro:shiro-core and may be impacted: - com.flowlogix:build-core =0.8.6, =0.8.6, =0.9, =0.8.9, =0.8.9, =1.0, =1.4.8, =1.4.10 -...

com.gestalt.common.injection:common-injection-spring-impl (0.8), com.google.code.struts2webflow:struts2webflow-parent (1.0.4) +39 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (2.0.1)

org.springframework:spring-core MAVEN version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - com.gestalt.common.injection:common-injection-spring-impl 0.8 -...

CVE-2026-44668

FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, AccessControlInterceptor, the authentication gate for all Struts2 actions, unconditionally calls invocation.invoke without checking for a valid session. Four action methods in BoilerPlateConfig perform no local...

org.apache.struts:struts2-jasperreports-plugin (>=2.5-beta3, <=2.5.33), org.seedstack.addons.io:io-jasper (>=2.1.0, <=3.0.0) +2 more potentially affected by CVE-2026-6009 via net.sf.jasperreports:jasperreports (6.0.3)

net.sf.jasperreports:jasperreports MAVEN version 6.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on net.sf.jasperreports:jasperreports and may be impacted: - org.apache.struts:struts2-jasperreports-plugin =2.5-beta3, =2.1.0, =2.0.0-m2, =2.0.0-m2,...