Class familyApache · Struts
Apache Struts expression language injection flaws, 2020–2026
3 Struts CVEs with CWE-917 weaknesses, 11 Dec 2020 to 5 Oct 2026. 1 is in CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it..
CVEs by year
Published each year. Select a CVE to open it.Grouped by product and weakness type (CWE); not proven to share a root cause.
1 2020’20
2021’21
1 2022’22
2023’23
2024’24
2025’25
1 2026’26
In CISA KEVNot in KEV
CVEs in this family
Table view of the years above| CVE | Published | Title | Linked from | Priority |
|---|---|---|---|---|
| CVE-2020-17530KEV | 11 Dec 2020 | Apache Struts Remote Code Execution Vulnerability · fixed in 2.5.26 | Grouped by weakness | 69.8 |
| CVE-2021-31805 | 12 Apr 2022 | Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE. · fixed in 2.5.30 | Grouped by weakness | 62.0 |
| CVE-2026-104711 | 5 Oct 2026 | Improper neutralization of special elements used in an expression language statement ('Expression Language Injection')… | Grouped by weakness | 23.5 |