Search for packages
| purl | pkg:maven/org.apache.tomcat/tomcat@10.0.0-M8 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 10.0 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2018-8014
|
Low: CORS filter has insecure defaults |
Vulnerable Vulnerable |
|
CVE-2016-6797
|
Low: Unrestricted Access to Global Resources |
Vulnerable |
|
CVE-2016-6796
|
Low: Security Manager Bypass |
Vulnerable |
|
CVE-2016-6794
|
Low: System Property Disclosure |
Vulnerable |
|
CVE-2016-5018
|
Low: Security Manager Bypass |
Vulnerable |
|
CVE-2016-0762
|
Low: Timing Attack |
Vulnerable |
|
CVE-2016-3092
|
Moderate: Denial of Service |
Vulnerable |
|
CVE-2013-4286
|
Important: Information disclosure | There are no reported fixed by versions. |
|
CVE-2018-8014
|
Low: CORS filter has insecure defaults | There are no reported fixed by versions. |
|
GHSA-4vww-mc66-62m6
Aliases: CVE-2021-33037 |
HTTP Request Smuggling in Apache Tomcat Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not … |
Vulnerable |
|
GHSA-36qh-35cm-5w2w
Aliases: CVE-2021-30640 |
Authentication Bypass by Alternate Name in Apache Tomcat A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker … |
Vulnerable |
|
GHSA-r84p-88g2-2vx2
Aliases: CVE-2022-29885 |
Apache Tomcat EncryptInterceptor error leads to Uncontrolled Resource Consumption The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, … |
Vulnerable |
|
GHSA-jx7c-7mj5-9438
Aliases: CVE-2021-43980 |
Apache Tomcat Race Condition vulnerability The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to … |
Vulnerable |
|
CVE-2021-24122
|
Information Exposure When serving resources from a network location using the NTFS file system, Apache Tomcat is susceptible to JSP … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2026-29146
|
Important: The fix for CVE-2026-29146 allowed the bypass of the EncryptInterceptor |
Vulnerable |
|
CVE-2022-42252
|
Low: Apache Tomcat request smuggling |
Vulnerable |
|
CVE-2022-34305
|
Low: Apache Tomcat XSS in examples web application |
Vulnerable |
|
CVE-2022-29885
|
Low: Apache Tomcat EncryptInterceptor DoS |
Vulnerable |
|
CVE-2021-43980
|
High: Information Disclosure |
Vulnerable |
|
CVE-2022-23181
|
Low: Local Privilege Escalation |
Vulnerable |
|
CVE-2021-33037
|
Important: Request Smuggling |
Vulnerable |
|
CVE-2021-30640
|
Low: Authentication weakness |
Vulnerable |
|
CVE-2021-41079
|
Important: Denial of Service |
Vulnerable |
|
CVE-2020-9484
|
Low: Fix for CVE-2020-9484 was incomplete |
Vulnerable |
|
CVE-2021-25122
|
Important: Request mix-up with h2c |
Vulnerable |
|
CVE-2021-24122
|
Important: Information disclosure |
Vulnerable |
|
CVE-2020-17527
|
Moderate: HTTP/2 request header mix-up |
Vulnerable |
|
CVE-2026-66299
|
Low: DoS in WebSocket chat example |
Vulnerable |
|
CVE-2018-8014
|
Low: CORS filter has insecure defaults | There are no reported fixed by versions. |
|
GHSA-wph7-x527-w3h5
Aliases: CVE-2021-42340 |
Missing Release of Resource after Effective Lifetime in Apache Tomcat The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-6j88-6whg-x687
Aliases: CVE-2022-34305 |
Cross-site Scripting in Apache Tomcat In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to … |
Vulnerable Vulnerable Vulnerable |