Security Bulletin: IBM Maximo Application Suite - Monitor Component uses tomcat-embed-core-10.1.54.jar which is vulnerable to CVE-2026-41293, CVE-2026-43512, CVE-2026-43513 and CVE-2026-43515.

Summary IBM Maximo Application Suite - Monitor Component uses tomcat-embed-core-10.1.54.jar which is vulnerable to CVE-2026-41293, CVE-2026-43512, CVE-2026-43513 and CVE-2026-43515. This bulletin contains information addressing the vulnerability. Vulnerability Details CVEID:CVE-2026-41293...

Security Bulletin: Maximo AI Service uses cryptography-46.0.6-cp311-abi3-manylinux_2_34_x86_64.whl and tomcat-embed-core-10.1.54.jar which are vulnerable to CVE-2026-39892, CVE-2026-41293, CVE-2026-43512, CVE-2026-43513 and CVE-2026-43515.

Summary Maximo AI Service uses cryptography-46.0.6-cp311-abi3-manylinux234x8664.whl and tomcat-embed-core-10.1.54.jar which are vulnerable to CVE-2026-39892, CVE-2026-41293, CVE-2026-43512, CVE-2026-43513 and CVE-2026-43515. This bulletin contains information regarding the vulnerability and its...

Security update for tomcat11 (important)

openSUSE security update: security update for tomcat11 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21121-1 Rating: important References: bsc1265145 bsc1265162 bsc1265163 bsc1265165 bsc1265166 bsc1265167 bsc1265168 Cross-References: CVE-2026-4128...

OPENSUSE-SU-2026:21117-1 Security update for tomcat

This update for tomcat fixes the following issues Update to Tomcat 9.0.118: - CVE-2026-41284: Unbounded read in WebDAV LOCK and PROPFIND handling bsc1265162. - CVE-2026-41293: HTTP/2 request headers not validated bsc1265163. - CVE-2026-42498: WebSocket authentication header exposure bsc1265165. -...

OPENSUSE-SU-2026:21122-1 Security update for tomcat10

This update for tomcat10 fixes the following issues Update to Tomcat 10.1.55: - CVE-2026-41284: Unbounded read in WebDAV LOCK and PROPFIND handling bsc1265162. - CVE-2026-41293: HTTP/2 request headers not validated bsc1265163. - CVE-2026-42498: WebSocket authentication header exposure bsc1265165....

SUSE SLES12 Security Update : tomcat (SUSE-SU-2026:2299-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2299-1 advisory. This update for tomcat fixes the following issues Update to Tomcat 9.0.118: - CVE-2026-41284: Unbounded read in WebDAV LOCK and PROPFIND handli...

Security update for tomcat

This update for tomcat fixes the following issues Update to Tomcat 9.0.118: CVE-2026-41284: Unbounded read in WebDAV LOCK and PROPFIND handling bsc1265162. CVE-2026-41293: HTTP/2 request headers not validated bsc1265163. CVE-2026-42498: WebSocket authentication header exposure bsc1265165...

TencentOS Server 4: tomcat (TSSA-2026:0337)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0337 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

tomcat10-10.1.55-1.1 on GA media (moderate)

tomcat10-10.1.55-1.1 on GA media Announcement ID: openSUSE-SU-2026:10926-1 Rating: moderate Cross-References: CVE-2026-41284 CVE-2026-41293 CVE-2026-42498 CVE-2026-43512 CVE-2026-43513 CVE-2026-43514 CVE-2026-43515 CVSS scores: CVE-2026-41284 SUSE : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:...

tomcat11-11.0.22-1.1 on GA media (moderate)

tomcat11-11.0.22-1.1 on GA media Announcement ID: openSUSE-SU-2026:10927-1 Rating: moderate Cross-References: CVE-2026-41284 CVE-2026-41293 CVE-2026-42498 CVE-2026-43512 CVE-2026-43513 CVE-2026-43514 CVE-2026-43515 CVSS scores: CVE-2026-41284 SUSE : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:...

CVE-2026-43515 vulnerabilities

Vulnerabilities for packages: ontop, thingsboard, nacos-docker, kayenta, kayenta-fips, ontop-fips, camunda, camunda-zeebe...

com.github.hazendaz.tomcat:tomcat10-config (>=10.1.2, <=10.1.54), io.orqueio.bpm.tomcat:orqueio-bpm-tomcat (>=1.0.0, <=1.0.11) +12 more potentially affected by CVE-2026-43515 via org.apache.tomcat:tomcat (>=10.1.2, <=10.1.54)

org.apache.tomcat:tomcat MAVEN version =10.1.2, =10.1.2, =1.0.0, =1.0.0, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.0.5 Source cves: CVE-2026-43515 Source advisory: GHSA-5M62-PW8W-7W9F...

ai.ylyue:yue-library-base (finchley.sr2.sr1), ai.ylyue:yue-library-data-jdbc (finchley.sr2.sr1) +712 more potentially affected by CVE-2026-43515 via org.apache.tomcat.embed:tomcat-embed-core (8.5.34)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.34 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - ai.ylyue:yue-library-base finchley.sr2.sr1 - ai.ylyue:yue-library-data-jdbc...

org.openl.rules.demo:openl-demo-app (5.21.0), org.openl.rules.demo:org.openl.rules.demo.demo (>=5.20.1, <=5.20.4) potentially affected by CVE-2026-43515 via org.apache.tomcat:tomcat (8.5.23)

org.apache.tomcat:tomcat MAVEN version 8.5.23 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat and may be impacted: - org.openl.rules.demo:openl-demo-app 5.21.0 - org.openl.rules.demo:org.openl.rules.demo.demo =5.20.1, =5.20.4...

org.apache.tomcat.embed:tomcat-embed-jasper (7.0.21) potentially affected by CVE-2026-43515 via org.apache.tomcat.embed:tomcat-embed-core (7.0.21)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.21 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.tomcat.embed:tomcat-embed-jasper 7.0.21 Source cves: CVE-2026-435...

am.ik.servicebroker:shared-smysql-service-broker (>=0.0.3, <=0.0.4), ch.awae:cloud-base (0.0.1) +1089 more potentially affected by CVE-2026-43515 via org.apache.tomcat.embed:tomcat-embed-core (8.5.31)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.31 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - am.ik.servicebroker:shared-smysql-service-broker =0.0.3, =1.5.13, =1.5.13,...

com.github.jsimone:webapp-runner (8.5.41.1), com.github.jsimone:webapp-runner-main (8.5.41.1) +15 more potentially affected by CVE-2026-43515 via org.apache.tomcat.embed:tomcat-embed-core (8.5.42)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.42 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.github.jsimone:webapp-runner 8.5.41.1 -...

ch.rasc:embeddedtc (1.23), ch.rasc:embeddedtc-maven-plugin (1.18) +6 more potentially affected by CVE-2026-43515 via org.apache.tomcat.embed:tomcat-embed-core (7.0.65)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.65 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - ch.rasc:embeddedtc 1.23 - ch.rasc:embeddedtc-maven-plugin 1.18 -...

com.github.jsimone:webapp-runner (7.0.84.0), org.apache.jspwiki:jspwiki-portable (>=2.10.3, <=2.10.4) +3 more potentially affected by CVE-2026-43515 via org.apache.tomcat.embed:tomcat-embed-core (7.0.84)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.84 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.github.jsimone:webapp-runner 7.0.84.0 -...

ch.rasc:embeddedtc (1.22), ch.rasc:embeddedtc-maven-plugin (1.17) +2 more potentially affected by CVE-2026-43515 via org.apache.tomcat.embed:tomcat-embed-core (7.0.64)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.64 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - ch.rasc:embeddedtc 1.22 - ch.rasc:embeddedtc-maven-plugin 1.17 -...