tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator

A flaw was found in Apache Tomcat. This vulnerability, an authentication bypass by capture-replay, affects the DIGEST authenticator. A remote attacker can exploit this by making a specially crafted DIGEST authenticated request with a nonceCount at the upper boundary of the replay window. This...

org.apache.tomcat/tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass

A flaw was found in Apache Tomcat. This incorrect authorization vulnerability occurs within the FORM authentication process, allowing a user to bypass security constraints. This bypass enables unauthorized access to resources via a GET request, even when those resources are intended to be...

tomcat: Apache Tomcat: Authenticated WebSocket session persists after HTTP session termination

A flaw was found in Apache Tomcat. This vulnerability, categorized as Insufficient Session Expiration, occurs when an authenticated HTTP session's ID is modified after a WebSocket connection has been established. Under these conditions, the WebSocket session fails to terminate as expected when th...

The vulnerability of the JNDIRealm component in the Apache Tomcat application server allows a hacker to bypass security restrictions.

The vulnerability of the JNDIRealm component in the Apache Tomcat application server is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to circumvent security restrictions remotely...

Apache Tomcat Path Equivalence - Remote Code Execution

Path Equivalence- 'file.Name' Internal Dot leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. id: CVE-2025-24813 info: name: Apache Tomcat Path Equivalence - Remote Code Execution...

CVE-2014-4140

creationtimestamp| type| source ---|---|--- 2026-09-02 01:00:10+00:00| seen| Telegram/795CHWfqDB8d387Ptvi9l1rsbPfOiWfhqBLWLBanVVXFSs 2026-09-03 00:00:55+00:00| published-proof-of-concept| Telegram/795CHWfqDB8d387Ptvi9l1rsbPfOiWfhqBLWLBanVVXFSs...

CVE-2021-31188

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:42+00:00| seen| https://t.me/hackingAttack/8312 2026-09-02 01:03:18+00:00| seen| https://t.me/hackingAttack/8312 2026-09-08 07:00:05+00:00| seen| https://t.me/hackingAttack/8312 2026-09-09 00:00:39+00:00| seen|...

CVE-2019-20790

creationtimestamp| type| source ---|---|--- 2026-09-01 20:01:59+00:00| seen| https://t.me/hackingAttack/38673 2026-09-02 01:02:22+00:00| seen| https://t.me/hackingAttack/38673 2026-09-06 13:00:05+00:00| published-proof-of-concept| https://t.me/hackingAttack/38673 2026-09-07 01:00:14+00:00|...

CVE-2026-66422

A flaw was found in Apache Tomcat. This improper authorization vulnerability occurs because security-role-ref definitions are incorrectly used as role aliases within the Realm, in addition to their correct usage with Request.isUserInRole. This misconfiguration allows for a bypass of declarative...

CVE-2026-73180

A flaw was found in Apache Tomcat. This vulnerability, categorized as Insufficient Session Expiration, occurs when an authenticated HTTP session's ID is modified after a WebSocket connection has been established. Under these conditions, the WebSocket session fails to terminate as expected when th...

CVE-2026-68525

A flaw was found in Apache Tomcat. This incorrect authorization vulnerability occurs within the FORM authentication process, allowing a user to bypass security constraints. This bypass enables unauthorized access to resources via a GET request, even when those resources are intended to be...

CVE-2026-65905

A flaw was found in Apache Tomcat. This vulnerability, an authentication bypass by capture-replay, affects the DIGEST authenticator. A remote attacker can exploit this by making a specially crafted DIGEST authenticated request with a nonceCount at the upper boundary of the replay window. This...

CVE-2026-68763

A flaw was found in Apache Tomcat. This vulnerability, an uncontrolled resource consumption issue, arises from an allocation leak in the HTTP/2 backlog tracking when a stream is reset. A remote attacker could exploit this to cause a Denial of Service DoS, making the server unresponsive or...

CVE-2026-68569

A flaw was found in Apache Tomcat. This improper authentication vulnerability allows a remote attacker to be authenticated even if their user account does not exist in the DataSourceRealm, under specific circumstances such as CLIENT-CERT or SPNEGO authentication. This can lead to unauthorized...

CVE-2026-65927

A flaw was found in Apache Tomcat. An off-by-one error in the RewriteValve's N flag processing causes rewrite rules to restart at the second rule instead of the first. This vulnerability may allow an attacker to bypass intended access controls. Mitigation Mitigation for this issue is either not...

CVE-2026-65183

A flaw was found in Apache Tomcat. A Time-of-check Time-of-use TOCTOU race condition exists when creating Unix domain sockets. This vulnerability allows an unauthorized local user to exploit the timing window to gain access to the Unix domain socket. This could lead to information disclosure or...

CVE-2026-65182

A flaw was found in Apache Tomcat. This improper access control and incorrect authorization vulnerability allows an attacker to bypass security constraints. This occurs when a security constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path, potential...

CVE-2026-65637

A flaw was found in Apache Tomcat. This improper input validation vulnerability, stemming from an incomplete fix for CVE-2026-32990, allows for an HTTP/2 no-authority bypass of strict Server Name Indication SNI validation. This could potentially lead to unauthorized access or misrouting of...

seans-surf-and-skate

Sean's Surf & Skate Co. — Seal Security Demo Maven / Java A small but real-looking e-commerce storefront "Sean's Surf & Skate Co." built with Spring Boot. It ships with known-vulnerable open-source dependencies so it can be used to demonstrate how Seal Security remediates CVEs with backported...

Amazon Linux 2 : tomcat, --advisory ALAS2TOMCAT9-2026-028 (ALASTOMCAT9-2026-028)

The version of tomcat installed on the remote host is prior to 9.0.121-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT9-2026-028 advisory. Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat:...