| CVE-2026-103119 |
Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body…
|
Not rated
|
Oct 20, 2026 |
| CVE-2026-101356 |
Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous…
|
Not rated
|
Oct 20, 2026 |
| CVE-2026-101296 |
A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with…
|
Not rated
|
Oct 20, 2026 |
| CVE-2026-93446 |
Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently
|
Not rated
|
Oct 20, 2026 |
| CVE-2026-88041 |
Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request to leak into…
|
Not rated
|
Oct 20, 2026 |
| CVE-2026-80353 |
Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for…
|
Not rated
|
Oct 20, 2026 |
| CVE-2026-74049 |
Execution After Redirect (EAR) vulnerability in Apache Tomcat
|
Not rated
|
Oct 20, 2026 |
| CVE-2026-74048 |
Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat
|
Not rated
|
Oct 20, 2026 |
| CVE-2026-87022 |
Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling…
|
Not rated
|
Sep 23, 2026 |
| CVE-2026-86350 |
Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused…
|
Not rated
|
Sep 23, 2026 |
| CVE-2026-86248 |
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in…
|
Not rated
|
Sep 23, 2026 |
| CVE-2026-79677 |
Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat…
|
Not rated
|
Sep 23, 2026 |
| CVE-2026-78437 |
Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause…
|
Not rated
|
Sep 23, 2026 |
| CVE-2026-78383 |
Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP…
|
Not rated
|
Sep 23, 2026 |
| CVE-2026-77791 |
Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS…
|
Not rated
|
Sep 23, 2026 |
| CVE-2026-77762 |
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache…
|
Not rated
|
Sep 23, 2026 |
| CVE-2026-77756 |
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused…
|
Not rated
|
Sep 23, 2026 |
| CVE-2026-76183 |
Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any…
|
Not rated
|
Sep 23, 2026 |
| CVE-2026-75973 |
Improper Authentication vulnerability in Apache Tomcat
|
Not rated
|
Sep 23, 2026 |
| CVE-2026-73581 |
Improper Check for Certificate Revocation vulnerability in Apache Tomcat
|
Not rated
|
Sep 23, 2026 |
| CVE-2026-73180 |
Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP…
|
Not rated
|
Aug 25, 2026 |
| CVE-2026-68763 |
Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking…
|
Not rated
|
Aug 25, 2026 |
| CVE-2026-68569 |
Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g
|
Not rated
|
Aug 25, 2026 |
| CVE-2026-68525 |
Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a…
|
Not rated
|
Aug 25, 2026 |
| CVE-2026-66422 |
Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as…
|
Not rated
|
Aug 25, 2026 |