CVE-2026-34486

CVE-2026-34486 affects Apache Tomcat versions 11.0.20, 10.1.53, and 9.0.116, describing Missing Encryption of Sensitive Data due to a fix for CVE-2026-29146 that allowed bypass of the EncryptInterceptor. The connected documents specify the vulnerable component as the EncryptInterceptor path in To...

CVE-2026-65637

Apache Tomcat contains an improper input validation vulnerability in its HTTP/2 implementation where the fix for CVE-2026-32990 (strict SNI validation) was incomplete, allowing a no-authority bypass of strict SNI validation . The issue affects 11.0.20–11.0.24 , 10.1.53–10.1.57 , and 9.0.115–9.0.1...