CRITICAL9.8CVE-2025-24813⚠ KEVApache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT >= 11.0.0-M1, < 11.0.3
CRITICAL9.8CVE-2016-8735⚠ KEVApache Tomcat Improper Access Control vulnerability from 0, < 6.0.48
HIGH8.1⚠ KEVtomcat7 - security update
>= 9.0.0.M1, < 9.0.1
CRITICAL9.8Apache Tomcat: Digest authenticator will authenticate any unknown user
from 0, < 9.0.118
CRITICAL9.8Apache Tomcat: HTTP/2 request headers not validated
from 0, < 9.0.118
CRITICAL9.8Apache Tomcat: Bypass of rules in Rewrite Valve
>= 9.0.76, < 9.0.104
CRITICAL9.8Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete
>= 11.0.0-M1, < 11.0.2
CRITICAL9.8Apache Tomcat: RCE due to TOCTOU issue in JSP compilation
>= 11.0.0-M1, < 11.0.2
CRITICAL9.8Apache Tomcat: Authentication bypass when using Jakarta Authentication API
from 0, < 9.0.96
CRITICAL9.6Apache Tomcat: console manipulation via escape sequences in log messages
>= 11.0.0-M1, < 11.0.11
CRITICAL9.1Apache Tomcat: Security constraints not correctly applied
from 0, < 9.0.118
CRITICAL9.1Exposure of Resource to Wrong Sphere in Apache Tomcat
>= 9.0.0.M1, < 9.0.0.M18
HIGH8.4Apache Tomcat: exe side-loading via icalcs.exe in Tomcat installer for Windows
>= 11.0.0-M1, < 11.0.8
HIGH8.1tomcat8 - security update
>= 7.0.0, < 7.0.72
HIGH7.5Apache Tomcat: LockOutRealm treats user names as case-sensitive
from 0, < 9.0.118
HIGH7.5Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling
from 0, < 9.0.118
HIGH7.5Apache Tomcat: Incomplete escaping of JSON access logs
>= 9.0.40, < 9.0.116
HIGH7.5Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled
>= 11.0.0-M1, < 11.0.11
HIGH7.5Apache Tomcat: DoS via integer overflow in multipart file upload
>= 11.0.0-M1, < 11.0.9
HIGH7.5Apache Tomcat: FileUpload large number of parts with headers DoS
>= 11.0.0-M1, < 11.0.8
HIGH7.5Apache Tomcat: Security constraint bypass for pre/post-resources
>= 11.0.0-M1, < 11.0.8
HIGH7.5Apache Tomcat: HTTP request smuggling via malformed trailer headers
>= 11.0.0-M1, < 11.0.0-M11
HIGH7.5tomcat9 - security update
>= 10.1.0-M1, < 10.1.5
HIGH7.5Apache Tomcat: JsonErrorReportValve escaping
>= 10.1.0, < 10.1.2
HIGH7.5tomcat7 - security update
>= 7.0.0, < 7.0.81
HIGH7.3Apache Tomcat: WebSocket authentication header exposure
from 0, < 9.0.118
HIGH7.3Apache Tomcat: Security constraint bypass for CGI scripts
>= 9.0.0.M1, < 9.0.105
HIGH7.0tomcat7 - security update
>= 10.0.0-M1, < 10.0.0-M5
MEDIUM6.5Apache Tomcat: session fixation via rewrite valve
>= 11.0.0-M1, < 11.0.8
MEDIUM6.1Apache Tomcat: Occasionally open redirect
>= 8.5.30, < 9.0.116
MEDIUM6.1Apache Tomcat: Open redirect with FORM authentication
>= 10.1.0-M1, < 10.1.13
MEDIUM6.1tomcat7 - security update
>= 9.0.0, < 9.0.17
MEDIUM5.3Apache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoS
>= 11.0.0-M1, < 11.0.12
MEDIUM5.3Apache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requests
>= 11.0.0-M1, < 11.0.0-M12
MEDIUM4.3Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations
>= 11.0.0-M1, < 11.0.0-M3
LOW3.7Apache Tomcat: AJP secret compared in non-constant time
from 0, < 9.0.118
—Improper Authentication in Apache Tomcat
>= 5.5.0, < 5.5.36
—Missing XML Validation in Apache Tomcat
from 0, < 6.0.40
—Improper Input Validation in Apache Tomcat
from 0, < 6.0.40