https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T15:17:26.935432+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2022-06000 bdu:2022-06000 2026-10-04T15:17:26.941752+00:00 bdu:2022-06000 https://cve.radiocsirt.org/vuln/certa-2013-avi-596 certa-2013-avi-596 — De multiples vulnérabilités ont été corrigées dans <span class="textit">Apache Struts</span>. Elles permettent à un att… 2026-10-04T15:17:26.941809+00:00 certa-2013-avi-596 https://cve.radiocsirt.org/vuln/euvd-2026-107338 EUVD-2026-107338 2026-10-04T15:17:26.941843+00:00 EUVD-2026-107338 https://cve.radiocsirt.org/vuln/fkie_cve-2013-4310 fkie_cve-2013-4310 2026-10-04T15:17:26.941855+00:00

Apache Struts 2.0.0 through 2.3.15.1 allows remote attackers to bypass access controls via a crafted action: prefix.

 https://cve.radiocsirt.org/vuln/ghsa-q5q8-jghf-3pm3 GHSA-q5q8-jghf-3pm3 — Apache Struts2 Broken Access Control Vulnerability 2026-10-04T15:17:26.941882+00:00

Affected: Maven: org.apache.struts:struts2-core

The Struts 2 action mapping mechanism supports the special parameter prefix action: which is intended to help with attaching navigational information to buttons within forms, under certain conditions this can be used to bypass security constraints.

In Struts 2.3.15.3 the action mapping mechanism was changed to avoid circumventing security constraints. Two additional constants were introduced to steer behaviour of DefaultActionMapper:

- struts.mapper.action.prefix.enabled - when set to false support for "action:" prefix is disabled, set to false by default - struts.mapper.action.prefix.crossNamespaces - when set to false, actions defined with "action:" prefix must be in the same namespace as current action

 https://cve.radiocsirt.org/vuln/gsd-2013-4310 gsd-2013-4310 2026-10-04T15:17:26.941911+00:00 gsd-2013-4310