CVE-2024-52318

CVE-2024-52318 🚨🚨CVE-2024-52318 - Vulnerabilità XSS in JSP Generate in Apache Tomcat🚨🚨 Panoramica CVE-2024-52318 è una vulnerabilità di cross-site scripting XSS in Apache Tomcat, che deriva dal rilascio improprio di risorse nelle JavaServer Pages JSP generate. Questo problema, introdotto da un...

CVE-2025-24813

Apache Tomcat Nicht authentifizierte RCE - CVE-2025-24813 Dieses Repository bietet eine Anleitung und eine Testumgebung zur Bewertung der CVE-2025-24813 -Sicherheitslücke. Details Betroffene Versionen: Apache Tomcat 11.0.0-M1 bis 11.0.2 Apache Tomcat 10.1.0-M1 bis 10.1.34 Apache Tomcat 9.0.0.M1 b...

CVE-2026-34486---unauthenticated-RCE-via-Java-deserialization

CVE-2026-34486 Apache Tomcat Tribes क्लस्टरिंग में EncryptInterceptor fail-open बाईपास, जो Java डिसीरियलाइज़ेशन के माध्यम से बिना प्रमाणीकरण के RCE की ओर ले जाता है। प्रभावित संस्करण: 11.0.19+, 10.1.53+, 9.0.116+। इनमें ठीक हुआ: 11.0.21, 10.1.54, 9.0.117। इनके द्वारा खोजा और रिपोर्ट किया गया:...

EUVD-2026-66130

Off-by-one Error vulnerability in Apache Tomcat impacting the N flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through...

EUVD-2026-66132

Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from...

EUVD-2026-66190

Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.39 through 9.0.120. The following versions were...

Linux Distros Unpatched Vulnerability : CVE-2026-65905

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a...

Linux Distros Unpatched Vulnerability : CVE-2026-65637

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.2...

Linux Distros Unpatched Vulnerability : CVE-2026-68525

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access t...

Linux Distros Unpatched Vulnerability : CVE-2026-65182

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specifi...

Linux Distros Unpatched Vulnerability : CVE-2026-65183

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Time-of-check Time-of-use TOCTOU Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the...

DEBIAN-CVE-2026-73180

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...

CVE-2026-73180

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...

DEBIAN-CVE-2026-65927

Off-by-one Error vulnerability in Apache Tomcat impacting the N flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through...

DEBIAN-CVE-2026-66422

Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 throu...

CVE-2026-65927

Off-by-one Error vulnerability in Apache Tomcat impacting the N flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through...

CVE-2026-65905

Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that request is replayable once only while...

CVE-2026-68525

Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from...

CVE-2026-65183

Time-of-check Time-of-use TOCTOU Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.42 throug...

CVE-2026-65637

Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121,...