Apache Tomcat vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
82 matching records
- High7.5Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.Check if you run itEPSS 8.85%Apr 9, 2026
- Critical9.1CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.Check if you run itEPSS 0.71%Apr 9, 2026
- High7.5Configured cipher preference order not preserved vulnerability in Apache Tomcat.Check if you run itEPSS 0.26%Apr 9, 2026
- Medium6.1Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve.Check if you run itEPSS 0.53%Apr 9, 2026
- High7.5Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.Check if you run itEPSS 0.70%Apr 9, 2026
- High7.5Apache Tomcat Missing Encryption of Sensitive Data VulnerabilityPatch nowKEVEPSS 98.50%Apr 9, 2026
- High8.8OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication.Check if you run itEPSS 0.42%Mar 30, 2026
- Critical9.3ZKTeco ZKBioSecurity 3.0 contains hardcoded credentials in the bundled Apache Tomcat server that allow unauthenticated attackers to access the manager application.Check if you run itEPSS 0.81%Mar 16, 2026
- Critical9.4A sandbox escape vulnerability exists in dotCMS’s Velocity scripting engine (VTools) that allows authenticated users with scripting privileges to bypass class and pack…Check if you run itEPSS 0.34%Feb 24, 2026
- Critical9.1In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management module, it is possible to execute any Java cCheck if you run itEPSS 1.06%Nov 7, 2025
- Medium5.3Improper Resource Shutdown or Release vulnerability in Apache Tomcat.Check if you run itEPSS 1.25%Oct 27, 2025
- High7.5Relative Path Traversal vulnerability in Apache Tomcat.Check this weekEPSS 64.41%Oct 27, 2025
- Critical9.6Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat.Check this weekEPSS 10.17%Oct 27, 2025
- High7.5Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack.Check if you run itEPSS 3.69%Aug 13, 2025
- Critical9.3SQL injection vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter.Check if you run itEPSS 0.48%Jul 8, 2025
- High7.3Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component ofCheck if you run itEPSS 3.14%May 29, 2025
- Critical9.8Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat.Check if you run itEPSS 4.26%Apr 28, 2025
- High7.5Improper Input Validation vulnerability in Apache Tomcat.Check this weekEPSS 61.32%Apr 28, 2025
- Critical9.8Apache Tomcat Path Equivalence VulnerabilityPatch nowKEVEPSS 99.94%Mar 10, 2025
- Critical9.8Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race ConditionPatch nowKEVEPSS 8.97%Dec 20, 2024
- Unknownpascom cloud_phone_system Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Patch nowKEVEPSS 20.80%Jan 22, 2024
- UnknownApache Tomcat Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Patch nowKEVEPSS 90.65%Dec 19, 2023
- UnknownApache Tomcat Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Patch nowKEVEPSS 6.71%Nov 9, 2023
- Critical9.8SysAid Server Path Traversal VulnerabilityPatch nowKEVEPSS 98.85%Nov 8, 2023
- UnknownApache Tomcat Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Patch nowKEVEPSS 99.92%Apr 12, 2021