CVE-2026-111249

Apache TomEE contains a vulnerability where the development-time LiveReload support listens on all network interfaces without authentication and accepts websocket connections from any origin. This issue specifically affects systems where LiveReload is enabled in the embedded Maven plugin . A netw...

CVE-2026-111249: Apache Software Foundation Apache TomEE: The development-time LiveReload support listens on all network interfaces without authentication and accepts websocket…

The development-time LiveReload support listens on all network interfaces without authentication and accepts websocket connections from any origin. A network attacker, or a web page visited by the developer, can observe the names of changed files in the watched folder and the server version, and...

org.apache.ode:ode-tomee (>=1.3.7, <=1.3.8), org.apache.tomee.maven:tomee-embedded-maven-plugin (>=7.0.0, <=7.1.4) +17 more potentially affected by CVE-2024-23672 via org.apache.tomcat:tomcat-websocket (>=8.5.2, <=8.5.95)

org.apache.tomcat:tomcat-websocket MAVEN version =8.5.2, =1.3.7, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =1.0.10-m10, =1.3.33 and more Source cves: CVE-2024-23672 Source advisory: OSV:GHSA-V682-8VV8-VPWR...