StackRadarChart IndexLive demo

CVE-2025-68493

High

Advisory

Published 11 Jan 2026In the index since 8 Sept 2026

Severity: High; worst across findings
CVSS: 8.1; base score, highest
EPSS: 0.433; 99th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 4; of 17,781 indexed, latest versions
Container images: 4; deployed by those charts
Fix available: None; affected package

Apache Struts 2 is Missing XML Validation

Carried by container images the latest versions of 4 of 17,781 indexed charts deploy, on 4 images.

Affected package	Affected versions	Fixed in	Images
struts2-coremaven	2.5.30, 2.5.32-atlassian-1, 2.5.33	no fix listed	4

OSV records: GHSA-qcfc-hmrc-59x7

Charts affected

4 by stars

Chart

Latest

Affected images

Radar Score

akto-ai-guardrails-v2akto

1 of 6 See more

akto-ai-guardrails-v2 akto 0.3.0

1 of the 6 container images this version deploys carry CVE-2025-68493.

Container image	Digest	Package	Fixed in
aktosecurity/data-ingestion-service :1.4.9	46ed5bcb04b2	struts2-core@2.5.33	no fix listed

Open the chart page →

9,321

akto-testing-db-layerakto

1 of 2 See more

akto-testing-db-layer akto 1.42.16

1 of the 2 container images this version deploys carry CVE-2025-68493.

Container image	Digest	Package	Fixed in
public.ecr.aws/aktosecurity/akto-api-security-testing-db-layer :1.59.3_local	8cdcb7e83f9f	struts2-core@2.5.30	no fix listed

Open the chart page →

5,489

data-ingestion-serviceakto

1 of 1 See more

data-ingestion-service akto 0.1.6

1 of the 1 container images this version deploys carry CVE-2025-68493.

Container image	Digest	Package	Fixed in
aktosecurity/data-ingestion-servicedigest-pinned	213aded7adc5	struts2-core@2.5.33	no fix listed

Open the chart page →

3,442

1 of 3 See more

crowd mox 2.4.3

1 of the 3 container images this version deploys carry CVE-2025-68493.

Container image	Digest	Package	Fixed in
atlassian/crowd :5.2.2	ebf761c7d437	struts2-core@2.5.32-atlassian-1	no fix listed

Open the chart page →

5,663

Container images carrying it

4 by charts deploying them

A fixed version is listed for 0 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
aktosecurity/data-ingestion-service	213aded7adc5	struts2-core@2.5.33	no fix listed	1
aktosecurity/data-ingestion-service :1.4.9	46ed5bcb04b2	struts2-core@2.5.33	no fix listed	1
atlassian/crowd :5.2.2	ebf761c7d437	struts2-core@2.5.32-atlassian-1	no fix listed	1
public.ecr.aws/aktosecurity/akto-api-security-testing-db-layer :1.59.3_local	8cdcb7e83f9f	struts2-core@2.5.30	no fix listed	1