Apache

Tomcat

263 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
7.3

CVE-2026-55957

Medienbericht
  • EPSS 0.46%
  • Veröffentlicht 29.06.2026 20:47:12
  • Zuletzt bearbeitet 02.07.2026 19:01:45

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: fr...

6.5

CVE-2026-55956

Medienbericht
  • EPSS 0.41%
  • Veröffentlicht 29.06.2026 20:46:02
  • Zuletzt bearbeitet 02.07.2026 19:03:30

Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint. This issue affects Apache Tomcat: from 11.0.0-M1 throu...

6.5

CVE-2026-55955

  • EPSS 0.28%
  • Veröffentlicht 29.06.2026 20:44:39
  • Zuletzt bearbeitet 02.07.2026 19:04:36

Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 ...

9.1

CVE-2026-55276

Medienbericht
  • EPSS 0.37%
  • Veröffentlicht 29.06.2026 20:42:23
  • Zuletzt bearbeitet 02.07.2026 19:05:18

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged. This issue affects Apache Tomcat: from 11.0.0-M1 throug...

9.1

CVE-2026-53434

Medienbericht
  • EPSS 0.37%
  • Veröffentlicht 29.06.2026 20:41:06
  • Zuletzt bearbeitet 02.07.2026 19:06:09

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118...

7.3

CVE-2026-53404

  • EPSS 0.41%
  • Veröffentlicht 29.06.2026 20:39:45
  • Zuletzt bearbeitet 02.07.2026 19:22:23

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped. This issue affects Apache Tomcat: from 11.0.0-M1 through...

6.1

CVE-2026-50229

  • EPSS 0.42%
  • Veröffentlicht 29.06.2026 20:36:24
  • Zuletzt bearbeitet 02.07.2026 19:24:34

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M...

9.1

CVE-2026-43515

Medienbericht
  • EPSS 1.14%
  • Veröffentlicht 12.05.2026 15:33:23
  • Zuletzt bearbeitet 15.05.2026 15:52:05

Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 thro...

3.7

CVE-2026-43514

  • EPSS 0.35%
  • Veröffentlicht 12.05.2026 15:32:09
  • Zuletzt bearbeitet 14.05.2026 18:46:41

Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from...

7.5

CVE-2026-43513

  • EPSS 0.47%
  • Veröffentlicht 12.05.2026 15:26:25
  • Zuletzt bearbeitet 15.05.2026 15:53:14

Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7...