{"apiVersion":"1","notice":"Security Threat Pulse API v1. Free, no key. Facts with sources; verdicts follow the published rules at https://securitythreatpulse.com/methodology. Not advice. Some source data is withheld here until its terms allow re-serving.","generatedAt":"2026-11-11T08:30:28.064Z","products":["apache"],"actNowTotal":1,"results":[{"query":"apache","matched":1,"actNow":1,"events":[{"id":"kev-2026-10-08-apache-struts","url":"https://securitythreatpulse.com/events/kev-2026-10-08-apache-struts","title":"Apache Struts: attackers can run commands on it","verdict":"act_now","verdictReason":"Attacks are confirmed. Ready-made attack tools are public. The exploit prediction score is 97%.","tier":"now","rankScore":4,"rankWhy":["Exploitation is confirmed by an authoritative source.","Ready-made attack tools are public."],"rulesVersion":"v3","ladder":{"talk":"none","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2016-3081"],"vendor":"Apache","product":"Struts","affectedProducts":[{"kind":"direct","slug":"apache/struts","vendor":"Apache","product":"Struts","evidence":["kev"],"vendorKey":"apache","productKey":"struts"}],"category":{"id":"website","label":"Website or online store","why":"It runs public websites, online stores or the software behind them.","doThis":"Ask whoever runs your website or store to update it."},"summary":"Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.","cvss":8.1,"epss":0.96916,"exploitMaturity":"weaponized","kevListed":true,"kevDateAdded":"2026-10-08","kevDueDate":"2026-10-11","firstSeenAt":"2026-10-08T00:00:00.000Z","updatedAt":"2026-11-08T16:37:40.566Z","newestEvidenceAt":"2026-10-24T23:23:07.941Z"}]}]}