CVE-2019-12418

CVE-2019-12418 affects Apache Tomcat 9.0.0.M1–9.0.28, 8.5.0–8.5.47, 7.0.0–7.0.97 when JMX Remote Lifecycle Listener is enabled: a local attacker without Tomcat access can manipulate the RMI registry to perform a MITM and steal credentials to gain full control of the Tomcat instance. Connected adv...

CVE-2019-2684

CVE-2019-2684 concerns Oracle Java SE and Java SE Embedded, specifically the RMI component. The connected Chainguard entry shows affected packages for OpenJDK builds (openjdk-21/openj9, openjdk-8/openj9, openjdk-11/openj9, openjdk-17/openj9). The initial description identifies affected Oracle Jav...

CVE-2026-66422

This is an Improper Authorization vulnerability in Apache Tomcat where security-role-ref definitions were incorrectly treated as role aliases within the Realm , enabling a bypass of declarative role constraints beyond the intended Request.isUserInRole() mechanism. Affected releases span 11.0.0-M1...