Login Request a demo
TO
Web Server
Tomcat
by Apache · last CVE Oct 20, 2026
On CISA KEVExploited in the wildRansomware-linked
296
CVEs
7
On KEV
9.8
Max CVSS
8
New 30D
Vulnerabilities296In the news2Timeline
Severity mix
Critical 31High 89Medium 43Low 4
Severity
All severities296Critical31High89Medium43Low4
Exploitation
On CISA KEV7Exploited in the wild7
Watch

Add Tomcat to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-77756
3.7
1%
Sep 23
Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests
Affected: 11.0.0-M1 through 11.0.25; 10.1.0-M1 through 10.1.59; 9.0.47 through 9.0.121; 8.5.67 through 8.5.100
CVE-2026-43514
3.7
0%
May 12
Apache Tomcat: AJP secret compared in non-constant time
Affected: 11.0.0-M1 through 11.0.21; 10.1.0-M1 through 10.1.54; 9.0.0.M1 through 9.0.117; 8.5.0 through 8.5.100; 7.0.0 through 7.0.109
CVE-2026-24733
3.7
1%
Feb 17
Apache Tomcat: Security constraint bypass with HTTP/0.9
Affected: 11.0.0-M1 through 11.0.14; 10.1.0-M1 through 10.1.49; 9.0.0.M1 through 9.0.112; through 8.5.100
CVE-2021-43980
3.7
2%
Sep 28
The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger)…
Affected: 8.5.0 through 8.5.77; 9.0.0 through 9.0.60; 10.0.0 through 10.0.18; 10.1.0; 10.1.0; 10.1.0; +9 more
Showing 4