Lucene search
+L

13746 matches found

OSV
OSV
added 2026/09/08 3:45 p.m.6 views

OPENSUSE-SU-2026:21811-1 Security update for tomcat11

This update for tomcat11 fixes the following issues: - CVE-2026-65182: Bypass longest prefix security constraint bsc1276893. - CVE-2026-65183: TOCTOU when setting specific permissions for Unix Domain Sockets bsc1276894. - CVE-2026-65637: HTTP/2 no-authority bypass of strict SNI validation - fix...

9.8CVSS0.0083EPSS
SaveExploits0References23
Kitploit
Kitploit
added 2026/09/08 1:54 p.m.8 views

tomcat-line-check

tomcat-line-check CVE-2026-24880 · GHSA-563x-q5rq-57qp — Does Apache's upgrade to version 11.0.20, 10.1.52 or 9.0.116 hold for you? For most people it doesn't, and there are four different ways it fails. This tool scans your artifact and tells you which one applies. root@kitploit: java -jar...

7.5CVSS7.4AI score0.0052EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/08 1:21 p.m.5 views

Ghostcat-Tomcat-AJP-Exploit-Py3

Herramienta de detección de vulnerabilidad Ghostcat en Tomcat CVE-2020-1938 / CNVD-2020-10487 Introducción Este proyecto proporciona un script de verificación en Python para validar la vulnerabilidad de inclusión local de archivos en el protocolo AJP de Apache Tomcat comúnmente conocida como...

9.8CVSS7.5AI score0.9927EPSS
SaveExploits51
Nuclei
Nuclei
added 2026/09/08 9:11 a.m.140 views

Apache Tomcat Tribes EncryptInterceptor Bypass - Remote Code Execution

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. id: CVE-2026-34486 info: name: Apache Tomcat Tribes EncryptInterceptor Bypass - Remote...

7.5CVSS7.5AI score0.98616EPSS
SaveExploits8References3
F5 Networks
F5 Networks
added 2026/09/08 7:23 a.m.12 views

K000163240: Multiple Apache Tomcat vulnerabilities

Security Advisory Description CVE-2026-65183 Time-of-check Time-of-use TOCTOU Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from...

9.8CVSS0.0083EPSS
SaveExploits0
F5 Networks
F5 Networks
added 2026/09/08 7:18 a.m.9 views

K000163239: Multiple Apache Tomcat vulnerabilities

Security Advisory Description CVE-2026-65182 Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. This issue affects Apache...

9.1CVSS0.00779EPSS
SaveExploits0
Nuclei
Nuclei
added 2026/09/07 6:34 a.m.88 views

Apache Tomcat `CGIServlet` enableCmdLineArguments - Remote Code Execution

When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by...

9.3CVSS7.6AI score0.99652EPSS
SaveExploits11References5
Nuclei
Nuclei
added 2026/09/07 6:34 a.m.112 views

Apache Tomcat JK Connect <=1.2.44 - Manager Access

Apache Tomcat JK modjk Connector 1.2.0 to 1.2.44 allows specially constructed requests to expose application functionality through the reverse proxy. It is also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is so...

7.5CVSS7.3AI score0.90647EPSS
SaveExploits0References5
OSV
OSV
added 2026/09/05 3:02 p.m.7 views

OESA-2026-3592 tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Security Fixes: Improper Access Control,...

9.8CVSS5.4AI score0.0083EPSS
SaveExploits0References11
Mageia
Mageia
added 2026/09/04 5:53 p.m.8 views

Updated tomcat packages fix security vulnerabilities

Incorrect URL decoding in RewriteValve may allow security control bypass. CVE-2026-59083 EncryptInterceptor requirements not clearly documented. CVE-2026-59084 DoS via WebSocket chat example. CVE-2026-66299 Bypass longest prefix security constraint. CVE-2026-65182 TOCTOU when setting specific...

9.8CVSS8.4AI score0.0083EPSS
SaveExploits1References17
OSV
OSV
added 2026/09/04 5:53 p.m.6 views

MGASA-2026-0376 Updated tomcat packages fix security vulnerabilities

Incorrect URL decoding in RewriteValve may allow security control bypass. CVE-2026-59083 EncryptInterceptor requirements not clearly documented. CVE-2026-59084 DoS via WebSocket chat example. CVE-2026-66299 Bypass longest prefix security constraint. CVE-2026-65182 TOCTOU when setting specific...

9.8CVSS8.3AI score0.0083EPSS
SaveExploits1References18
GithubExploit
GithubExploit
added 2026/09/04 3:45 a.m.22 views

Exploit for CVE-2020-1938

CVE-2020-1938 Tomcat File Read / File Include Ghostcat — pyt...

9.8CVSS7.5AI score0.9927EPSS
SaveExploits51
GithubExploit
GithubExploit
added 2026/09/04 3:45 a.m.30 views

Exploit for CVE-2020-1938

CVE-2020-1938 Tomcat File Read / File Include Ghostcat — pyt...

9.8CVSS6.9AI score0.9927EPSS
SaveExploits51
RedHat Linux
RedHat Linux
added 2026/09/03 9:43 a.m.9 views

Apache Tomcat: Apache Tomcat: Security constraint bypass due to improper access control

A flaw was found in Apache Tomcat. This improper access control and incorrect authorization vulnerability allows an attacker to bypass security constraints. This occurs when a security constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path, potential...

9.1CVSS5.8AI score0.0059EPSS
SaveExploits0References5
RedHat Linux
RedHat Linux
added 2026/09/03 9:43 a.m.8 views

tomcat: Apache Tomcat: Local information disclosure via Unix domain socket TOCTOU race condition

A flaw was found in Apache Tomcat. A Time-of-check Time-of-use TOCTOU race condition exists when creating Unix domain sockets. This vulnerability allows an unauthorized local user to exploit the timing window to gain access to the Unix domain socket. This could lead to information disclosure or...

8.1CVSS5.8AI score0.00452EPSS
SaveExploits0References5
RedHat Linux
RedHat Linux
added 2026/09/03 9:43 a.m.9 views

org.apache.tomcat/tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak

A flaw was found in Apache Tomcat. This vulnerability, an uncontrolled resource consumption issue, arises from an allocation leak in the HTTP/2 backlog tracking when a stream is reset. A remote attacker could exploit this to cause a Denial of Service DoS, making the server unresponsive or...

7.5CVSS5.9AI score0.0083EPSS
SaveExploits0References5
RedHat Linux
RedHat Linux
added 2026/09/03 9:43 a.m.12 views

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: tomcat10: tomcat10-10.1.59-0.1.hum1 noarch tomcat10-admin-webapps-10.1.59-0.1.hum1 noarch tomcat10-common-10.1.59-0.1.hum1 noarch tomcat10-docs-webapp-10.1.59-0.1.hum1 noarch...

9.8CVSS5.9AI score0.0083EPSS
SaveExploits0References11
RedHat Linux
RedHat Linux
added 2026/09/03 9:43 a.m.9 views

Apache Tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation

A flaw was found in Apache Tomcat. This improper input validation vulnerability, stemming from an incomplete fix for CVE-2026-32990, allows for an HTTP/2 no-authority bypass of strict Server Name Indication SNI validation. This could potentially lead to unauthorized access or misrouting of reques...

9.8CVSS5.8AI score0.00754EPSS
SaveExploits0References5
RedHat Linux
RedHat Linux
added 2026/09/03 9:43 a.m.10 views

tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing

A flaw was found in Apache Tomcat. An off-by-one error in the RewriteValve's N flag processing causes rewrite rules to restart at the second rule instead of the first. This vulnerability may allow an attacker to bypass intended access controls...

7.5CVSS5.8AI score0.00779EPSS
SaveExploits0References5
RedHat Linux
RedHat Linux
added 2026/09/03 9:43 a.m.13 views

tomcat: Apache Tomcat: Improper Authorization allows bypass of declarative role constraints

A flaw was found in Apache Tomcat. This improper authorization vulnerability occurs because security-role-ref definitions are incorrectly used as role aliases within the Realm, in addition to their correct usage with Request.isUserInRole. This misconfiguration allows for a bypass of declarative...

8.1CVSS5.8AI score0.00574EPSS
SaveExploits0References5
Rows per page
Query Builder