# Apache Struts


- [CVE-2020-17530](https://insights.sbomify.com/CVE-2020-17530/): Apache Struts Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2017-9791](https://insights.sbomify.com/CVE-2017-9791/): Apache Struts 1 Improper Input Validation (critical 9.8, exploited in the wild)
- [CVE-2017-5638](https://insights.sbomify.com/CVE-2017-5638/): Apache Struts Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2013-2251](https://insights.sbomify.com/CVE-2013-2251/): Apache Struts Improper Input Validation (critical 9.8, exploited in the wild)
- [CVE-2012-0391](https://insights.sbomify.com/CVE-2012-0391/): Apache Struts 2 Improper Input Validation (critical 9.8, exploited in the wild)
- [CVE-2018-11776](https://insights.sbomify.com/CVE-2018-11776/): Apache Struts Remote Code Execution (high 8.1, exploited in the wild)
- [CVE-2017-9805](https://insights.sbomify.com/CVE-2017-9805/): Apache Struts Deserialization of Untrusted Data (high 8.1, exploited in the wild)
- [CVE-2016-3081](https://insights.sbomify.com/CVE-2016-3081/): Apache Struts Command Injection (high 8.1, exploited in the wild)
- [CVE-2006-1547](https://insights.sbomify.com/CVE-2006-1547/): Apache Struts 1 ActionForm Denial-of-Service (high 7.5, exploited in the wild)
- [CVE-2013-4316](https://insights.sbomify.com/CVE-2013-4316/): Code injection in Apache Struts (critical 10.0)
- [CVE-2012-0838](https://insights.sbomify.com/CVE-2012-0838/): Apache Struts Code injection due to conversion error (critical 10.0)
- [CVE-2026-104711](https://insights.sbomify.com/CVE-2026-104711/): Apache Struts: OGNL injection in the legacy RESTful action mapper (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/products/apache/struts/