https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 16:17:48 +0000 https://db.gcve.eu/vuln/cve-2026-104711 <p><strong>Affected:</strong> Apache Software Foundation Apache Struts</p> <p>Improper neutralization of special elements used in an expression language statement (&#39;Expression Language Injection&#39;) vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Struts 7 is affected only when the OGNL allowlist is disabled; it is enabled by default. Applications using the default action mapper, the restful2 mapper, or the Struts REST plugin are not affected.</p> <p>This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.</p> <p>Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.</p> <p><strong>Affected:</strong> Apache Software Foundation Apache Struts</p> <p>Improper neutralization of special elements used in an expression language statement (&#39;Expression Language Injection&#39;) vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Struts 7 is affected only when the OGNL allowlist is disabled; it is enabled by default. Applications using the default action mapper, the restful2 mapper, or the Struts REST plugin are not affected.</p> <p>This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.</p> <p>Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.</p> https://db.gcve.eu/vuln/cve-2026-104711