CVE-2025-68493High· 8.1▾ MidnightPoC availableMissing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes th…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 44.6 · likelihood 10.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 2 sources. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Jul 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
23%
1 GitHub repo · Nuclei ×1
23% → 50%
Missing XML Validation vulnerability in Apache Struts, Apache Struts.
This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0.
Users are recommended to upgrade to version 6.1.1, which fixes the issue.
struts >= 2.0.0, <= 2.3.37struts >= 2.5.0, <= 2.5.33struts >= 6.0.0, < 6.1.1Upgrade past the affected range:
struts 6.1.1Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-104711Critical· 9.8Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts
CVE-2026-104712High· 7.5Asymmetric resource consumption (amplification) vulnerability in Apache Struts
CVE-2026-63292High· 7.5Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request…
CVE-2026-49875Critical· 9.8Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgr…
CVE-2026-40682Critical· 9.1XML External Entity (XXE) via Unsanitized Dictionary Parsing in Apache OpenNLP DictionaryEntryPersistor Versions Affected: before 2.5.9, before 3.0.0-M3 Description: The DictionaryEntryPersistor class initializes a static SAXParserFa…
CVE-2020-26258Medium· 6.3XStream is a Java library to serialize objects to XML and back again