https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T20:06:38.113584+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2015-00401 bdu:2015-00401 2026-10-03T20:06:38.118572+00:00 bdu:2015-00401 https://cve.radiocsirt.org/vuln/certfr-2014-avi-208 certfr-2014-avi-208 — De multiples vulnérabilités ont été corrigées dans <span class="textit">Apache Struts</span>. Elles permettent à un att… 2026-10-03T20:06:38.118605+00:00 certfr-2014-avi-208 https://cve.radiocsirt.org/vuln/euvd-2026-96728 EUVD-2026-96728 2026-10-03T20:06:38.118624+00:00 EUVD-2026-96728 https://cve.radiocsirt.org/vuln/fkie_cve-2014-0113 fkie_cve-2014-0113 2026-10-03T20:06:38.118636+00:00

CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.

 https://cve.radiocsirt.org/vuln/ghsa-3c5c-xrq4-qhr8 GHSA-3c5c-xrq4-qhr8 — ClassLoader manipulation in Apache Struts 2026-10-03T20:06:38.118664+00:00

Affected: Maven: org.apache.struts:struts2-core

CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.

 https://cve.radiocsirt.org/vuln/gsd-2014-0113 gsd-2014-0113 2026-10-03T20:06:38.118688+00:00 gsd-2014-0113