CISA Adds Actively Exploited Apache Struts Command Injection Flaw to KEV Catalog
CISA added actively exploited Apache Struts command-injection flaw CVE-2016-3081 to the KEV catalog.
76
Product
Apache Struts
- Mentions · 7d0
- Mentions · 30d15
- All mentions16
- First seenAug 17, 2026
- Last mentioned18d ago
Timeline
16 articles · newest firstU.S. CISA adds ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND flaws to its Known Exploited Vulnerabilities catalog
CISA added five exploited ProFTPD, ONLYOFFICE, Strapi, Struts, and BIND flaws to the KEV catalog.
78
Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies
CISA added five Flax Typhoon-exploited flaws to the KEV catalog, with a federal patch deadline of October 11.
86
US Disrupts China-Linked Integrity Tech ‘s Cyber Espionage Tools
US authorities seized China-linked Integrity Tech tools Microscan and FishHub used to hack critical infrastructure.
84
US Disrupts Chinese State-Sponsored Hacking Tools
The US seized domains for Chinese state-sponsored tools MicroScan and FishHub used against critical infrastructure.
78
FBI Seized Vulnerability Scanning and Spear Phishing Tools Used by China-Linked Hackers
The FBI seized seven domains for Microscan and FishHub tools used by China-linked Flax Typhoon contractor Integrity Technology Group.
78
FBI disrupts Chinese hacking tools used to breach critical infrastructure
FBI seized Flax Typhoon domains for tools used in critical-infrastructure intrusions.
86
FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails
FBI and six countries say China-linked Integrity Technology Group stole emails and shared them via a third-party portal.
79
Critical Apache Struts Vulnerabilities Enables Remote Code Execution Attacks
Apache discloses four Struts flaws, including OGNL injection that can enable remote code execution.
66
Apache Struts Vulnerabilities Enable Remote Code Execution, DoS and Data Disclosure
Four Apache Struts flaws can enable remote code execution, denial of service, or cross-user data disclosure.
66
CVE-2026-104714: Apache Struts: Shared message formatter exposes date and time values across concurrent requests
Apache Struts CVE-2026-104714 is a moderate race that can leak formatted dates across requests.
44
CVE-2026-104713: Apache Struts: Unbounded request body read in the REST plugin
Apache Struts REST plugin reads request bodies without a size limit, enabling memory-exhaustion denial of service.
58
CVE-2026-104712: Apache Struts: Disproportionate response size when rendering BigDecimal request parameters
Apache Struts can amplify responses when rendering BigDecimal parameters, tracked as CVE-2026-104712.
46
CVE-2026-104711: Apache Struts: OGNL injection in the legacy RESTful action mapper
Apache Struts legacy RESTful action mapper is vulnerable to OGNL injection as CVE-2026-104711.
58
IQUALIF France Leak, IUT Paris Seine Breach, US IAB Auction, SMTP Credential Dump, and Apache Struts Exploit Sale
SOCRadar flagged alleged French leaks, an SMTP dump, a US access auction, and a Struts exploit sale.
52
Another Apache Log4j Vulnerability Is Actively Exploited in the Wild (CVE-2021
Apache Log4j 2 RCE CVE-2021-44228 is actively exploited via crafted JNDI lookups; Palo Alto Unit 42 urges upgrading to Log4j 2.17.1.
92
Related CVEs
by mentions- CVE-2016-308197%8.1Command injection RCE in Apache Struts Dynamic Method Invocation
- CVE-2015-330699%10.0Arbitrary file read/write via ProFTPD 1.3.5 mod_copy
- CVE-2021-319930%9.8Path Traversal RCE in ONLYOFFICE Document Server
- CVE-2015-5477100%7.5Remote denial of service in ISC BIND via TKEY queries
- CVE-2023-228944%4.9Sensitive-data leak in Strapi admin query filters (through 4.5.5)
- CVE-2019-11510100%10.0Unauthenticated Arbitrary File Read in Ivanti Pulse Connect Secure VPN
- CVE-2021-22205100%10.0Unauthenticated RCE in GitLab CE/EE via ExifTool Image Parsing (CVE-2021-22205)
- CVE-2026-1047111%9.8OGNL injection in Apache Struts legacy REST mapper
- Race condition in Apache Struts leaks dates across users
- Unbounded request-body DoS in Apache Struts REST plugin
Appears with
- Apachevendor · 11
- Flax Typhoonthreat actor · 6
- Microsoftvendor · 6
- Apache Software Foundationorganization · 6
- Integrity Technology Grouporganization · 5
- Microsoft Exchangeproduct · 5
- U.S. Department of Justiceorganization · 4
- Miraimalware · 4
- Ethereal Pandathreat actor · 4
- CISAorganization · 4
- Jenkinsproduct · 3
- FishHubproduct · 3
- Federal Bureau of Investigationorganization · 3
- Strapivendor · 3
- GitLabvendor · 3
- Microscanproduct · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.