| CVE-2016-5388 |
high |
8.1 |
8.1 |
|
|
|
10y ago |
Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted cli… |
| CVE-2025-46701 |
high |
— |
8.0 |
|
|
|
16d ago |
Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to th… |
| CVE-2025-55668 |
high |
— |
8.0 |
|
|
|
16d ago |
Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Old… |
| CVE-2025-31651 |
high |
— |
8.0 |
|
|
|
6mo ago |
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to… |
| CVE-2025-49125 |
high |
— |
8.0 |
|
|
|
10mo ago |
Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. When using PreResources or PostResources mounted other than at the root of the web application, it was possib… |
| CVE-2025-48988 |
high |
— |
8.0 |
|
|
|
10mo ago |
Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 th… |
| CVE-2025-52520 |
high |
— |
8.0 |
|
|
|
10mo ago |
For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits. This issue affects Apache Tomcat: from 11.0… |
| CVE-2024-56337 |
high |
— |
8.0 |
|
|
|
11mo ago |
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 throu… |
| CVE-2023-46589 |
high |
— |
8.0 |
|
|
|
2y ago |
Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not c… |
| CVE-2020-9484 |
high |
— |
8.0 |
|
|
|
6y ago |
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; … |
| CVE-2026-43513 |
high |
7.5 |
7.5 |
|
|
|
23d ago |
Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 … |
| CVE-2026-41284 |
high |
7.5 |
7.5 |
|
|
|
23d ago |
Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 t… |
| CVE-2025-55752 |
high |
7.5 |
7.5 |
|
|
|
6mo ago |
Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the po… |
| CVE-2017-12616 |
high |
7.5 |
7.5 |
|
|
|
9y ago |
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat |
| CVE-2026-42498 |
high |
7.3 |
7.3 |
|
|
|
23d ago |
Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1… |
| CVE-2017-12617 |
unknown |
— |
2.5 |
|
|
|
4y ago |
When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the serv… |
| CVE-2016-8735 |
unknown |
— |
1.5 |
|
|
|
4y ago |
Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This C… |
| CVE-2026-34483 |
unknown |
— |
— |
|
|
|
2mo ago |
Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 1… |
| CVE-2026-34487 |
unknown |
— |
— |
|
|
|
2mo ago |
Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token. This issue affects Apache Tomcat… |
| CVE-2026-25854 |
unknown |
— |
— |
|
|
|
2mo ago |
Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, fro… |
| CVE-2026-24733 |
unknown |
— |
— |
|
|
|
4mo ago |
Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny… |
| CVE-2025-66614 |
unknown |
— |
— |
|
|
|
4mo ago |
Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112. The following versions were… |
| CVE-2025-49124 |
unknown |
— |
— |
|
|
|
1y ago |
Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path. This issue affects A… |
| CVE-2024-52316 |
unknown |
— |
— |
|
|
|
2y ago |
Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception dur… |
| CVE-2022-45143 |
unknown |
— |
— |
|
|
|
4y ago |
The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from use… |
