| CVE-2026-65927 |
Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing…
|
Not rated
|
Aug 25, 2026 |
| CVE-2026-65905 |
Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator
|
Not rated
|
Aug 25, 2026 |
| CVE-2026-65637 |
Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990
|
Not rated
|
Aug 25, 2026 |
| CVE-2026-65183 |
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets…
|
Not rated
|
Aug 25, 2026 |
| CVE-2026-65182 |
Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a…
|
Not rated
|
Aug 25, 2026 |
| CVE-2026-66299 |
Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example
|
Not rated
|
Jul 28, 2026 |
| CVE-2026-59084 |
Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the…
|
Not rated
|
Jul 14, 2026 |
| CVE-2026-59083 |
Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security…
|
Not rated
|
Jul 14, 2026 |
| CVE-2026-55957 |
Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate…
|
Not rated
|
Jun 29, 2026 |
| CVE-2026-55956 |
Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet…
|
Not rated
|
Jun 29, 2026 |
| CVE-2026-55955 |
Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in…
|
Not rated
|
Jun 29, 2026 |
| CVE-2026-55276 |
Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty…
|
Not rated
|
Jun 29, 2026 |
| CVE-2026-53434 |
Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based…
|
Not rated
|
Jun 29, 2026 |
| CVE-2026-53404 |
Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first…
|
Not rated
|
Jun 29, 2026 |
| CVE-2026-50229 |
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess…
|
Not rated
|
Jun 29, 2026 |
| CVE-2026-43515 |
Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in…
|
Not rated
|
May 12, 2026 |
| CVE-2026-43514 |
Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat
|
Not rated
|
May 12, 2026 |
| CVE-2026-43513 |
Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat
|
Not rated
|
May 12, 2026 |
| CVE-2026-43512 |
DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat
|
Not rated
|
May 12, 2026 |
| CVE-2026-41293 |
Improper Input Validation vulnerability in Apache Tomcat
|
Not rated
|
May 12, 2026 |
| CVE-2026-42498 |
Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache…
|
Not rated
|
May 12, 2026 |
| CVE-2026-41284 |
Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat
|
Not rated
|
May 12, 2026 |
| CVE-2026-34500 |
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in…
|
Not rated
|
Apr 9, 2026 |
| CVE-2026-34487 |
Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of…
|
Not rated
|
Apr 9, 2026 |
| CVE-2026-34486 |
Exploited
Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
|
Not rated
|
Apr 9, 2026 |