Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High8.2OpenMRS Core is an open source electronic medical record system platform.May 5, 2026
- Medium6.5CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.Apr 9, 2026
- High7.5Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token.Apr 9, 2026
- High7.5Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat.Apr 9, 2026
- Medium5.3Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.Apr 9, 2026
- High7.5Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.Apr 9, 2026
- Critical9.1CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.Apr 9, 2026
- High7.5Configured cipher preference order not preserved vulnerability in Apache Tomcat.Apr 9, 2026
- Medium6.1Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve.Apr 9, 2026
- High7.5Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.Apr 9, 2026
- High7.5Apache Tomcat Missing Encryption of Sensitive Data VulnerabilityKEVEPSS 6.6%Apr 9, 2026
- High8.8OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication.Mar 30, 2026
- Critical9.3ZKTeco ZKBioSecurity 3.0 contains hardcoded credentials in the bundled Apache Tomcat server that allow unauthenticated attackers to access the manager application.Mar 16, 2026
- Critical9.4A sandbox escape vulnerability exists in dotCMS’s Velocity scripting engine (VTools) that allows authenticated users with scripting privileges to bypass class and pack…Feb 24, 2026
- Critical9.8Apache Tomcat Path Equivalence VulnerabilityKEVEPSS 99.9%Mar 10, 2025
- Critical9.8SysAid Server Path Traversal VulnerabilityKEVEPSS 98.9%Nov 9, 2023
- Critical9.8Spring Framework JDK 9+ Remote Code Execution VulnerabilityKEVEPSS 99.6%Apr 1, 2022
- Critical9.8Apache Tomcat Improper Privilege Management VulnerabilityKEVEPSS 99.3%Feb 24, 2020
- Medium4.3When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g.Oct 4, 2018
- Critical9.8The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable '…May 16, 2018
- Medium5.9The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC…Feb 28, 2018
- Medium6.5Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied…Feb 23, 2018
- High8.1Apache Tomcat Remote Code Execution VulnerabilityKEVEPSS 100.0%Oct 3, 2017
- High7.5When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources serv…Sep 19, 2017
- High8.1Apache Tomcat on Windows Remote Code Execution VulnerabilityKEVEPSS 99.6%Sep 19, 2017
45 records · page 1 of 2
PreviousNext