CVE-2026-34486

CVE-2026-34486 is a Missing Encryption of Sensitive Data vulnerability in Apache Tomcat versions 11.0.20, 10.1.53, and 9.0.116, introduced by the fix for CVE-2026-29146 (a Padding Oracle in the EncryptInterceptor ). The flaw resides in the Tribes cluster communication module : when EncryptInterce...

CVE-2026-68569

CVE-2026-68569 is an Improper Authentication vulnerability in Apache Tomcat 's DataSourceRealm . In CLIENT-CERT and SPNEGO authentication modes, a user could be authenticated and receive a partially populated Principal even if that user did not exist in the configured database. The fix (included ...