org.apache.tomcat:tomcat vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-65905Criticalorg.apache.tomcat:tomcat: Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability CVE-2026-65182Criticalorg.apache.tomcat:tomcat: Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability CVE-2026-68525Criticalorg.apache.tomcat:tomcat: Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability CVE-2026-41284Highorg.apache.tomcat.embed:tomcat-embed-core: Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling CVE-2026-43512Criticalorg.apache.tomcat.embed:tomcat-embed-core: Apache Tomcat - Digest authenticator will authenticate any unknown user CVE-2026-43513Highorg.apache.tomcat.embed:tomcat-embed-core: Apache Tomcat: LockOutRealm treats user names as case-sensitive CVE-2026-43515Criticalorg.apache.tomcat.embed:tomcat-embed-core: Apache Tomcat - Security constraints not correctly applied CVE-2026-43514Loworg.apache.tomcat.embed:tomcat-embed-core: Apache Tomcat - AJP secret compared in non-constant time CVE-2026-41293Criticalorg.apache.tomcat.embed:tomcat-embed-core: Apache Tomcat - HTTP/2 request headers not validated CVE-2026-42498Highorg.apache.tomcat.embed:tomcat-embed-core: Apache Tomcat - WebSocket authentication header exposure CVE-2026-34486Highorg.apache.tomcat:tomcat: Apache Tomcat Missing Encryption of Sensitive Data vulnerability CVE-2026-34483Highorg.apache.tomcat:tomcat-catalina: Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve CVE-2026-34487Highorg.apache.tomcat:tomcat: Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File CVE-2026-32990Mediumorg.apache.tomcat:tomcat: Apache Tomcat has an Improper Input Validation vulnerability CVE-2026-25854Mediumorg.apache.tomcat:tomcat-catalina: Apache Tomcat has an Open Redirect vulnerability CVE-2026-29129Highorg.apache.tomcat:tomcat: Apache Tomcat: Configured cipher preference order not preserved CVE-2026-29145Criticalorg.apache.tomcat:tomcat: Apache Tomcat: CLIENT_CERT authentication does not fail as expected CVE-2026-29146Highorg.apache.tomcat:tomcat: Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor CVE-2025-66614Mediumorg.apache.tomcat.embed:tomcat-embed-core: Apache Tomcat - Client certificate verification bypass CVE-2025-55754Loworg.apache.tomcat:tomcat: Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences CVE-2025-61795Loworg.apache.tomcat:tomcat: Apache Tomcat Vulnerable to Improper Resource Shutdown or Release CVE-2025-55752Highorg.apache.tomcat:tomcat: Apache Tomcat Vulnerable to Relative Path Traversal CVE-2025-49124Mediumorg.apache.tomcat.embed:tomcat-embed-core: Apache Tomcat installer for Windows has an untrusted search path vulnerability CVE-2024-54677Mediumorg.apache.tomcat:tomcat: Apache Tomcat Uncontrolled Resource Consumption vulnerability CVE-2024-52318Mediumorg.apache.tomcat:tomcat-jasper: Apache Tomcat - XSS in generated JSPs

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo