Search for packages
| purl | pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.0.35 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 10.0 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-9xcj-c8cr-8c3c
Aliases: CVE-2019-17563 |
In Apache Tomcat, when using FORM authentication there was a narrow window where an attacker could perform a session fixation … |
Vulnerable |
|
GHSA-gx5v-xp9w-j4cg
Aliases: CVE-2026-41284 |
Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 … |
Vulnerable |
|
GHSA-5mp6-jrq3-r938
Aliases: CVE-2026-43513 |
Apache Tomcat: LockOutRealm treats user names as case-sensitive Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This … |
Vulnerable |
|
GHSA-5m62-pw8w-7w9f
Aliases: CVE-2026-43515 |
Apache Tomcat - Security constraints not correctly applied Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 … |
Vulnerable |
|
GHSA-fv25-8xcx-gqjc
Aliases: CVE-2026-42498 |
Apache Tomcat - WebSocket authentication header exposure Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 Apache … |
Vulnerable |
|
GHSA-h6fc-48rj-7qqh
Aliases: CVE-2026-43512 |
Apache Tomcat - Digest authenticator will authenticate any unknown user Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 … |
Vulnerable |
|
GHSA-9m89-8frq-c98c
Aliases: CVE-2026-43514 |
Apache Tomcat - AJP secret compared in non-constant time Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to … |
Vulnerable |
|
GHSA-qxf4-chvg-4r8r
Aliases: CVE-2020-1935 |
Potential HTTP request smuggling in Apache Tomcat In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 … |
Vulnerable |
|
GHSA-c9hw-wf7x-jp9j
Aliases: CVE-2020-1938 |
Improper Privilege Management in Tomcat When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections … |
Vulnerable |
|
CVE-2019-12418
Aliases: GHSA-hh3j-x4mc-g48r |
In Apache Tomcat, a local attacker may be able to perform a man-in-the-middle attack to capture user names and passwords … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2020-8022
Aliases: GHSA-gc58-v8h3-x2gr |
A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, … |
Vulnerable Vulnerable |
|
CVE-2016-6794
|
Information Exposure When a `SecurityManager` is configured, a web application's ability to read system properties should be controlled by the … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2017-5664
|
Improper Handling of Exceptional Conditions The error page mechanism of the Java Servlet Specification requires that, when an error occurs … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2017-5648
|
Exposure of Resource to Wrong Sphere Some calls to application listeners in Apache Tomcat did not use the appropriate facade … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2016-8745
|
Information Exposure A bug in the error handling of the NIO HTTP connector in Apache Tomcat resulted in the current … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-8vmx-qmch-mpqg
Aliases: CVE-2019-0232 |
Apache Tomcat OS Command Injection vulnerability When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 … |
Vulnerable Vulnerable |
|
GHSA-qcxh-w3j9-58qr
Aliases: CVE-2019-0199 |
Apache Tomcat Denial of Service vulnerability The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted … |
Vulnerable Vulnerable |
|
GHSA-m59c-jpc8-m2x4
Aliases: CVE-2018-1336 |
In Apache Tomcat there is an improper handing of overflow in the UTF-8 decoder An improper handing of overflow in … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-46j3-r4pj-4835
Aliases: CVE-2018-8034 |
The host name verification missing in Apache Tomcat The host name verification when using TLS with the WebSocket client was … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-6rxj-58jh-436r
Aliases: CVE-2018-1304 |
Apache Tomcat unauthorized access vulnerability The URL pattern of "" (the empty string) which exactly maps to the context root … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-r4x2-3cq5-hqvp
Aliases: CVE-2018-8014 |
The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins The … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-jgwr-3qm3-26f3
Aliases: CVE-2021-25329 |
Potential remote code execution in Apache Tomcat The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, … |
Vulnerable Vulnerable |
|
GHSA-3vx3-xf6q-r5xp
Aliases: CVE-2017-5648 |
Exposure of Resource to Wrong Sphere in Apache Tomcat While investigating bug 60718, it was noticed that some calls to … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-xjgh-84hx-56c5
Aliases: CVE-2017-12617 |
Unrestricted Upload of File with Dangerous Type Apache Tomcat When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-hh3j-x4mc-g48r
Aliases: CVE-2019-12418 |
Insufficiently Protected Credentials in Apache Tomcat When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured … |
Vulnerable Vulnerable |
|
GHSA-563x-q5rq-57qp
Aliases: CVE-2026-24880 |
Apache Tomcat has an HTTP Request/Response Smuggling vulnerability Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-344f-f5vg-2jfj
Aliases: CVE-2020-9484 |
Potential remote code execution in Apache Tomcat When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |