Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.apache.tomcat/tomcat@10.0.27
purl pkg:maven/org.apache.tomcat/tomcat@10.0.27
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk score 3.9
Vulnerabilities affecting this package (13)
Advisory Summary Fixed in package version
CVE-2018-8014

Low: CORS filter has insecure defaults
8.0.53
Vulnerable
8.5.32
Vulnerable
CVE-2016-6797

Low: Unrestricted Access to Global Resources
8.5.5
Vulnerable
CVE-2016-6796

Low: Security Manager Bypass
8.5.5
Vulnerable
CVE-2016-6794

Low: System Property Disclosure
8.5.5
Vulnerable
CVE-2016-5018

Low: Security Manager Bypass
8.5.5
Vulnerable
CVE-2016-0762

Low: Timing Attack
8.5.5
Vulnerable
CVE-2016-3092

Moderate: Denial of Service
8.5.3
Vulnerable
CVE-2013-4286

Important: Information disclosure There are no reported fixed by versions.
CVE-2018-8014

Low: CORS filter has insecure defaults There are no reported fixed by versions.
CVE-2021-42340

Missing Release of Resource after Effective Lifetime tomcat is vulnerable to a memory leak that, over time, could lead to …
8.5.72
Vulnerable
9.0.54
Vulnerable
8.5.72
Vulnerable
9.0.54
Vulnerable
CVE-2026-29146

Important: The fix for CVE-2026-29146 allowed the bypass of the EncryptInterceptor
10.1.53
Vulnerable
CVE-2026-66299

Low: DoS in WebSocket chat example
9.0.121
Vulnerable
CVE-2018-8014

Low: CORS filter has insecure defaults There are no reported fixed by versions.
Vulnerabilities fixed by this package (2)

Advisory Summary Aliases
CVE-2022-42252
Improper Input Validation If Apache Tomcat 8.5.0 to 8.5.52, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was … GHSA-p22x-g9px-3945
CVE-2022-42252
Low: Apache Tomcat request smuggling