Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Critical9.3efw4.X is an Enterprise Framework for Web.May 12, 2026
- Critical9.1Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat.May 12, 2026
- Low3.7Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat.May 12, 2026
- High7.5Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.May 12, 2026
- Critical9.8DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat.May 12, 2026
- High7.3Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat.May 12, 2026
- Critical9.8Improper Input Validation vulnerability in Apache Tomcat.May 12, 2026
- High7.5Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.May 12, 2026
- High8.2OpenMRS Core is an open source electronic medical record system platform.May 5, 2026
- Medium6.5CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.Apr 9, 2026
- High7.5Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token.Apr 9, 2026
- High7.5Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat.Apr 9, 2026
- Medium5.3Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.Apr 9, 2026
- High7.5Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.Apr 9, 2026
- Critical9.1CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.Apr 9, 2026
- High7.5Configured cipher preference order not preserved vulnerability in Apache Tomcat.Apr 9, 2026
- Medium6.1Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve.Apr 9, 2026
- High7.5Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.Apr 9, 2026
- High7.5Apache Tomcat Missing Encryption of Sensitive Data VulnerabilityKEVEPSS 6.6%Apr 9, 2026
- High8.8OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication.Mar 30, 2026
- Critical9.3ZKTeco ZKBioSecurity 3.0 contains hardcoded credentials in the bundled Apache Tomcat server that allow unauthenticated attackers to access the manager application.EPSS 0.8%Mar 16, 2026
- Critical9.4A sandbox escape vulnerability exists in dotCMS’s Velocity scripting engine (VTools) that allows authenticated users with scripting privileges to bypass class and pack…EPSS 0.3%Feb 24, 2026
- Critical9.8Apache Tomcat Path Equivalence VulnerabilityKEVEPSS 99.9%Mar 10, 2025
- Critical9.8SysAid Server Path Traversal VulnerabilityKEVEPSS 98.9%Nov 9, 2023
- Critical9.8Spring Framework JDK 9+ Remote Code Execution VulnerabilityKEVEPSS 99.6%Apr 1, 2022
53 records · page 1 of 3
PreviousNext