| Apache Tomcat has a Cross-site Scripting vulnerabilityCVE-2026-50229 · GHSA-PG42-RG8C-J886 |
org.apache.tomcat:tomcatRed Hat Enterprise Linux 10/tomcat |
MavenRed Hat |
Medium
|
Fix reported |
|
| Apache Tomcat's rewrite valve has an Always-Incorrect Control Flow Implementation vulnerabilityCVE-2026-53404 · GHSA-H792-V28V-PPGR |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-catalina |
MavenRed Hat |
High
|
Fix reported |
|
| Apache Tomcat has an Always-Incorrect Control Flow Implementation vulnerabilityCVE-2026-55276 · GHSA-MQG3-R7H5-24X4 |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-util-scan |
MavenRed Hat |
Critical
|
Fix reported |
|
| Apache Tomcat has an Improper Authentication vulnerabilityCVE-2026-55955 · GHSA-C5PH-RGHF-FJFJ |
org.apache.tomcat:tomcat-tribesorg.apache.tomcat:tomcat |
MavenRed Hat |
Medium
|
Fix reported |
|
| Apache Tomcat has an Improper Authorization vulnerabilityCVE-2026-55956 · GHSA-5V3H-FJV2-54FG |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-catalina |
MavenRed Hat |
Medium
|
Fix reported |
|
| Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validationCVE-2026-65637 · GHSA-F525-44XV-F2QJ |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-coyote |
MavenRed Hat |
Critical
|
Fix reported |
|
| Apache Tomcat util accepted misconfigured CRLsCVE-2026-53434 · GHSA-4X29-79GH-6V8Q |
org.apache.tomcat:tomcat-utilRed Hat Enterprise Linux 10/tomcat |
MavenRed Hat |
Critical
|
Fix reported |
|
| Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerabilityCVE-2026-68525 · GHSA-H3X4-894J-XPX5 |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-catalina |
MavenRed Hat |
Critical
|
Fix reported |
|
| Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerabilityCVE-2026-65905 · GHSA-9XV2-5V5Q-P794 |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-catalina |
MavenRed Hat |
Critical
|
Fix reported |
|
| Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerabilityCVE-2026-65182 · GHSA-GCX9-497G-6CP6 |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-catalina |
MavenRed Hat |
Critical
|
Fix reported |
|
| Apache Tomcat - Client certificate verification bypassCVE-2025-66614 · GHSA-FPJ8-GQ4V-P354 |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-coyote |
MavenRed Hat |
Medium
|
Fix reported |
|
| Apache Tomcat vulnerable to Insertion of Sensitive Information into Log FileCVE-2026-34487 · GHSA-X4M4-345F-5H5G |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-tribes |
MavenRed Hat |
High
|
Fix reported |
|
| Apache Tomcat - Security constraint bypass with HTTP/0.9CVE-2026-24733 · GHSA-QQ5R-98HH-RXC9 |
org.apache.tomcat:tomcat-coyoteRed Hat Enterprise Linux 10/tomcat |
MavenRed Hat |
Low
|
Fix reported |
|
| Apache Tomcat: CLIENT_CERT authentication does not fail as expectedCVE-2026-29145 · GHSA-95JQ-RWVF-VJX4 |
org.apache.tomcat:tomcat-coyote-ffmorg.apache.tomcat:tomcat |
MavenRed Hat |
Critical
|
Fix reported |
|
| Apache Tomcat has an HTTP Request/Response Smuggling vulnerabilityCVE-2026-24880 · GHSA-563X-Q5RQ-57QP |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-coyote |
MavenRed Hat |
High
|
Fix reported |
|
| Apache Tomcat: CLIENT_CERT authentication does not fail as expectedCVE-2026-34500 · GHSA-24J9-X2WG-9QV6 |
org.apache.tomcat:tomcat-coyote-ffmRed Hat Enterprise Linux 10/tomcat |
MavenRed Hat |
Medium
|
Fix reported |
|
| Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValveCVE-2026-34483 · GHSA-RV64-5GF8-9QQ8 |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-catalina |
MavenRed Hat |
High
|
Fix reported |
|
| Apache Tomcat has an Open Redirect vulnerabilityCVE-2026-25854 · GHSA-9M3C-QCXR-9X87 |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-catalina |
MavenRed Hat |
Medium
|
Fix reported |
|
| tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valveCVE-2026-59083 |
Red Hat Enterprise Linux 10/tomcatRed Hat Enterprise Linux 6/tomcat6 |
Red Hat |
Low
|
No fix reported |
|
| tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurationsCVE-2026-59084 |
Red Hat Enterprise Linux 10/tomcatRed Hat Enterprise Linux 6/tomcat6 |
Red Hat |
Low
|
No fix reported |
|
