Search for packages
| purl | pkg:maven/org.apache.tomcat/tomcat@10.0.23 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 3.9 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2018-8014
|
Low: CORS filter has insecure defaults |
Vulnerable Vulnerable |
|
CVE-2016-6797
|
Low: Unrestricted Access to Global Resources |
Vulnerable |
|
CVE-2016-6796
|
Low: Security Manager Bypass |
Vulnerable |
|
CVE-2016-6794
|
Low: System Property Disclosure |
Vulnerable |
|
CVE-2016-5018
|
Low: Security Manager Bypass |
Vulnerable |
|
CVE-2016-0762
|
Low: Timing Attack |
Vulnerable |
|
CVE-2016-3092
|
Moderate: Denial of Service |
Vulnerable |
|
CVE-2013-4286
|
Important: Information disclosure | There are no reported fixed by versions. |
|
CVE-2018-8014
|
Low: CORS filter has insecure defaults | There are no reported fixed by versions. |
|
CVE-2022-42252
Aliases: GHSA-p22x-g9px-3945 |
Improper Input Validation If Apache Tomcat 8.5.0 to 8.5.52, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2021-42340
|
Missing Release of Resource after Effective Lifetime tomcat is vulnerable to a memory leak that, over time, could lead to … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2026-29146
|
Important: The fix for CVE-2026-29146 allowed the bypass of the EncryptInterceptor |
Vulnerable |
|
CVE-2022-42252
|
Low: Apache Tomcat request smuggling |
Vulnerable |
|
CVE-2026-66299
|
Low: DoS in WebSocket chat example |
Vulnerable |
|
CVE-2018-8014
|
Low: CORS filter has insecure defaults | There are no reported fixed by versions. |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2022-34305
|
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 … |
GHSA-6j88-6whg-x687
|
|
CVE-2022-34305
|
Low: Apache Tomcat XSS in examples web application |