TO
Web Server
Tomcat
On CISA KEVExploited in the wildRansomware-linked
296
CVEs
7
On KEV
9.8
Max CVSS
8
New 30D
Severity mix
Critical 31High 89Medium 43Low 4
Watch
Add Tomcat to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-24813 In wildKEV | 9.8 | Mar 10 | Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT Affected: 11.0.0-M1 through 11.0.2; 10.1.0-M1 through 10.1.34; 9.0.0.M1 through 9.0.98; 8.5.0 through 8.5.100 |
| CVE-2020-1938 In wildKEV | 9.8 | Feb 24 | Apache Tomcat Improper Privilege Management Vulnerability Affected: Apache Tomcat 9.0.0.M1 to 9.0.0.30; 8.5.0 to 8.5.50; 7.0.0 to 7.0.99 |
| CVE-2016-8735 In wildKEV | 9.8 | Apr 6 | Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if… Affected: before 6.0.48; 7.x before 7.0.73; 8.x before 8.0.39; 8.5.x before 8.5.7; 9.x before 9.0.0.M12 |
| CVE-2026-86248 | 9.8 | Sep 23 | Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled Affected: 11.0.0-M14 through 11.0.25; 10.1.22 through 10.1.59; 9.0.92 through 9.0.121 |
| CVE-2026-76183 | 9.8 | Sep 23 | Apache Tomcat: Bypass of security constraints for WebSocket endpoints Affected: 11.0.0-M1 through 11.0.25; 10.1.0-M1 through 10.1.59; 9.0.0.M1 through 9.0.121; 8.5.0 through 8.5.100; 7.0.43 through 7.0.109 |
| CVE-2026-65905 | 9.8 | Aug 25 | Apache Tomcat: Limited replay attack possible with DIGEST authentication Affected: 11.0.0-M1 through 11.0.24; 10.1.0-M1 through 10.1.57; 9.0.0.M1 through 9.0.120; 8.5.0 through 8.5.100; 7.0.30 through 7.0.109 |
| CVE-2026-65637 | 9.8 | Aug 25 | Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete Affected: 11.0.20 through 11.0.24; 10.1.53 through 10.1.57; 9.0.115 through 9.0.120 |
| CVE-2026-43512 | 9.8 | May 12 | Apache Tomcat: Digest authenticator will authenticate any unknown user Affected: 11.0.0-M1 through 11.0.21; 10.1.0-M1 through 10.1.54; 9.0.0.M1 through 9.0.117; 8.5.0 through 8.5.100; 7.0.0 through 7.0.109 |
| CVE-2026-41293 | 9.8 | May 12 | Apache Tomcat: HTTP/2 request headers not validated Affected: 11.0.0-M1 through 11.0.21; 10.1.0-M1 through 10.1.54; 9.0.0.M1 through 9.0.117; 10.0.0-M1 through 10.0.27; 8.5.0 through 8.5.100 |
| CVE-2025-31651 | 9.8 | Apr 28 | Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a… Affected: 9.0.0 before 9.0.104; 10.1.0 before 10.1.40; 11.0.0 before 11.0.6 |
| CVE-2024-56337 | 9.8 | Dec 20 | Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete Affected: 11.0.0-M1 through 11.0.1; 10.1.0-M1 through 10.1.33; 9.0.0.M1 through 9.0.97; 8.5.0 through 8.5.100 |
| CVE-2024-50379 | 9.8 | Dec 17 | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is… Affected: 9.0.0 before 9.0.98; 10.1.0 before 10.1.34; 11.0.0 before 11.0.2 |
| CVE-2024-52316 | 9.8 | Nov 18 | Unchecked Error Condition vulnerability in Apache Tomcat Affected: 9.0.0 before 9.0.96; 10.1.0 before 10.1.31; 11.0.0; 11.0.0; 11.0.0; 11.0.0; +22 more |
| CVE-2018-8014 | 9.8 | May 16 | The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable… Affected: 9.0.0.M1 to 9.0.8; 8.5.0 to 8.5.31; 8.0.0.RC1 to 8.0.52; 7.0.41 to 7.0.88 |
| CVE-2017-5651 | 9.8 | Apr 17 | In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing Affected: 8.5.0; 8.5.1; 8.5.2; 8.5.3; 8.5.4; 8.5.5; +25 more |
| CVE-2025-55754 | 9.6 | Oct 27 | Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat Affected: 8.5.60 through 8.5.100; 9.0.40 before 9.0.109; 10.0.0 before 10.0.27; 10.1.0 before 10.1.45; 11.0.0 before 11.0.11 |
| CVE-2026-103119 | 9.1 | Oct 20 | Apache Tomcat: AJP response mix-up Affected: 11.0.0-M25 through 11.0.26 |
| CVE-2026-101356 | 9.1 | Oct 20 | Apache Tomcat: HTTP/2 request/response mix-up after error during async processing Affected: 11.0.22 through 11.0.26; 10.1.55 through 10.1.60; 9.0.118 through 9.0.122 |
| CVE-2026-101296 | 9.1 | Oct 20 | Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms Affected: 11.0.0-M1 through 11.0.26; 10.1.0-M1 through 10.1.60; 9.0.0.M1 through 9.0.122; 8.5.0 through 8.5.100; 7.0.0 through 7.0.109 |
| CVE-2026-86350 | 9.1 | Sep 23 | Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up Affected: 11.0.22 through 11.0.25; 10.1.55 through 10.1.59; 9.0.118 through 9.0.121 |
| CVE-2026-68525 | 9.1 | Aug 25 | Apache Tomcat: Redirect after FORM auth may bypass method specific constraints Affected: 11.0.0-M1 through 11.0.24; 10.1.0-M1 through 10.1.57; 9.0.0.M1 through 9.0.120; 8.5.0 through 8.5.100; 7.0.0 through 7.0.109 |
| CVE-2026-65182 | 9.1 | Aug 25 | Apache Tomcat: Bypass longest prefix security constraint Affected: 11.0.0-M1 through 11.0.24; 10.1.0-M1 through 10.1.57; 9.0.0.M1 through 9.0.120; 8.5.0 through 8.5.100; 7.0.0 through 7.0.109 |
| CVE-2026-59084 | 9.1 | Jul 14 | Apache Tomcat: EncryptInterceptor requirements not clearly documented Affected: 11.0.0-M1 through 11.0.23; 10.1.0-M1 through 10.1.56; 9.0.13 through 9.0.119; 8.5.38 through 8.5.100; 7.0.100 through 7.0.109 |
| CVE-2026-59083 | 9.1 | Jul 14 | Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass Affected: 11.0.0-M1 through 11.0.23; 10.1.0-M1 through 10.1.56; 9.0.0.M1 through 9.0.119; 8.5.0 through 8.5.100 |
| CVE-2026-55276 | 9.1 | Jun 29 | Apache Tomcat: Logged effective web.xml is incomplete Affected: 11.0.0-M1 through 11.0.22; 10.1.0-M1 through 10.1.55; 9.0.0.M1 through 9.0.118; 8.5.0 through 8.5.100 |
| CVE-2026-53434 | 9.1 | Jun 29 | Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector Affected: 11.0.0-M1 through 11.0.22; 10.1.0-M7 through 10.1.55; 9.0.83 through 9.0.118 |
| CVE-2026-43515 | 9.1 | May 12 | Apache Tomcat: Security constraints not correctly applied Affected: 11.0.0-M1 through 11.0.21; 10.1.0-M1 through 10.1.54; 9.0.0.M1 through 9.0.117; 8.5.0 through 8.5.100; 7.0.0 through 7.0.109 |
| CVE-2026-29145 | 9.1 | Apr 9 | Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled Affected: 11.0.0-M1 through 11.0.18; 10.1.0-M7 through 10.1.52; 9.0.83 through 9.0.115 |
| CVE-2025-66614 | 9.1 | Feb 17 | Apache Tomcat: Client certificate verification bypass due to virtual host mapping Affected: 11.0.0-M1 through 11.0.14; 10.1.0-M1 through 10.1.49; 9.0.0-M1 through 9.0.112; 8.5.0 through 8.5.100 |
| CVE-2016-5018 | 9.1 | Aug 10 | In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured… Affected: 9.0.0.M1 to 9.0.0.M9; 8.5.0 to 8.5.4; 8.0.0.RC1 to 8.0.36; 7.0.0 to 7.0.70; 6.0.0 to 6.0.45 |
| CVE-2017-5648 | 9.1 | Apr 17 | While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to… Affected: 9.0.0.M1 to 9.0.0.M17; 8.5.0 to 8.5.11; 8.0.0.RC1 to 8.0.41; 7.0.0 to 7.0.75 |
Showing 31