CVE-2026-8830

Technical details (affected product/version, root cause specifics, impact, or remediation) are not publicly available in the provided documents; monitor for updates.

PT-2026-41841

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw in the OpenID Connect OIDC Introspection feature occurs when both realm-level and client-level notBefore revocation policies are configured. In this scenario, the system fails to...

CVE-2026-44000 vm2: sandbox boundary bypass via host Promise resolution preserving host object identity

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox boundary violation in vm2 allows host object identity to cross into the sandbox through host Promise resolution. When a host-side Promise that resolves to a host object is exposed to the sandbox, the value delivered to the...

CVE-2026-44000 vm2: sandbox boundary bypass via host Promise resolution preserving host object identity

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox boundary violation in vm2 allows host object identity to cross into the sandbox through host Promise resolution. When a host-side Promise that resolves to a host object is exposed to the sandbox, the value delivered to the...

CVE-2026-44000 vm2: sandbox boundary bypass via host Promise resolution preserving host object identity

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox boundary violation in vm2 allows host object identity to cross into the sandbox through host Promise resolution. When a host-side Promise that resolves to a host object is exposed to the sandbox, the value delivered to the...

CVE-2026-44000

CVE-2026-44000 (vm2) : A sandbox boundary bypass in vm2 prior to version 3.11.0 allows host object identity to cross into the sandbox via host Promise resolution. When a host-side Promise resolves to a host object and is exposed to the sandbox, the value delivered to the sandbox .then() callback ...

br.net.woodstock.rockframework:rockframework-struts2 (>=2.0.0, <=2.0.8), br.net.woodstock.rockframework:rockframework-web (>=1.2.4, <=3.0.1) +8 more potentially affected by CVE-2026-43515 via org.apache.tomcat:tomcat-catalina (7.0.22)

org.apache.tomcat:tomcat-catalina MAVEN version 7.0.22 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - br.net.woodstock.rockframework:rockframework-struts2 =2.0.0, =1.2.4, =1.0-rc42, =1.0-rc42,...

br.net.woodstock.rockframework:rockframework-struts2 (>=2.0.0, <=2.0.8), br.net.woodstock.rockframework:rockframework-web (>=1.2.4, <=3.0.1) +8 more potentially affected by CVE-2026-42498 via org.apache.tomcat:tomcat-catalina (7.0.22)

org.apache.tomcat:tomcat-catalina MAVEN version 7.0.22 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - br.net.woodstock.rockframework:rockframework-struts2 =2.0.0, =1.2.4, =1.0-rc42, =1.0-rc42,...

br.net.woodstock.rockframework:rockframework-struts2 (>=2.0.0, <=2.0.8), br.net.woodstock.rockframework:rockframework-web (>=1.2.4, <=3.0.1) +8 more potentially affected by CVE-2026-41284 via org.apache.tomcat:tomcat-catalina (7.0.22)

org.apache.tomcat:tomcat-catalina MAVEN version 7.0.22 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - br.net.woodstock.rockframework:rockframework-struts2 =2.0.0, =1.2.4, =1.0-rc42, =1.0-rc42,...

br.net.woodstock.rockframework:rockframework-struts2 (>=2.0.0, <=2.0.8), br.net.woodstock.rockframework:rockframework-web (>=1.2.4, <=3.0.1) +8 more potentially affected by CVE-2026-43514 via org.apache.tomcat:tomcat-catalina (7.0.22)

org.apache.tomcat:tomcat-catalina MAVEN version 7.0.22 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - br.net.woodstock.rockframework:rockframework-struts2 =2.0.0, =1.2.4, =1.0-rc42, =1.0-rc42,...

br.net.woodstock.rockframework:rockframework-struts2 (>=2.0.0, <=2.0.8), br.net.woodstock.rockframework:rockframework-web (>=1.2.4, <=3.0.1) +8 more potentially affected by CVE-2026-43512 via org.apache.tomcat:tomcat-catalina (7.0.22)

org.apache.tomcat:tomcat-catalina MAVEN version 7.0.22 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - br.net.woodstock.rockframework:rockframework-struts2 =2.0.0, =1.2.4, =1.0-rc42, =1.0-rc42,...

DEBIAN-CVE-2026-43513

Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older unsupported versions...

CVE-2026-43513 Apache Tomcat: LockOutRealm treats user names as case-sensitive

Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older unsupported versions...

CVE-2026-43513

Apache Tomcat is vulnerable to an Improper Handling of Case Sensitivity vulnerability within the LockOutRealm component. This issue arises from deficiencies in the mechanism for handling register-dependent data, potentially allowing a malicious actor to bypass existing security measures remotely....

Apache Tomcat 安全漏洞

Apache Tomcat is a lightweight web application server developed by the Apache Foundation in the United States. It supports Servlet and JavaServer Page JSP technologies. Security vulnerabilities exist in versions of Apache Tomcat ranging from 11.0.0-M1 to 11.0.21, from 10.1.0-M1 to 10.1.54, from...

Apache Tomcat 10.1.0.M1 < 10.1.55 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 10.1.55. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat10.1.55security-10 advisory. - DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat...

Apache Tomcat 9.0.0.M1 < 9.0.118 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 9.0.118. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat9.0.118security-9 advisory. - DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. Th...

Unity Linux 20.1060e / 20.1070e Security Update: tomcat (UTSA-2026-017519)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017519 advisory. A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection...

PT-2026-40072

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.21 Apache Tomcat versions 10.1.0-M1 through 10.1.54 Apache Tomcat versions 9.0.0.M1 through 9.0.117 Apache Tomcat versions 8.5.0 through 8.5.100 Apache Tomcat versions 7.0.0 through 7.0.109...

Fixed in Apache Tomcat 10.1.55

Moderate: Security constraints not correctly applied CVE-2026-43515 When multiple security constraints defined an HTTP method constraint for the same extension pattern, only the first method constraint was applied. This was fixed with commit c6213173. This issue was reported to the Tomcat securit...