Search for packages
| purl | pkg:maven/org.apache.tomcat/tomcat@7.0.100 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 10.0 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2018-8014
|
Low: CORS filter has insecure defaults |
Vulnerable Vulnerable |
|
CVE-2016-6797
|
Low: Unrestricted Access to Global Resources |
Vulnerable |
|
CVE-2016-6796
|
Low: Security Manager Bypass |
Vulnerable |
|
CVE-2016-6794
|
Low: System Property Disclosure |
Vulnerable |
|
CVE-2016-5018
|
Low: Security Manager Bypass |
Vulnerable |
|
CVE-2016-0762
|
Low: Timing Attack |
Vulnerable |
|
CVE-2016-3092
|
Moderate: Denial of Service |
Vulnerable |
|
CVE-2021-30640
|
Low: Authentication weakness |
Vulnerable |
|
CVE-2020-9484
|
Low: Fix for CVE-2020-9484 was incomplete |
Vulnerable Vulnerable |
|
CVE-2021-24122
|
Important: Information disclosure |
Vulnerable |
|
CVE-2020-13935
|
Important: WebSocket DoS |
Vulnerable |
|
CVE-2018-8014
|
Low: CORS filter has insecure defaults | There are no reported fixed by versions. |
|
GHSA-44qp-qhfv-c7f6
Aliases: CVE-2021-30639 |
Improper Handling of Exceptional Conditions in Apache Tomcat A vulnerability in Apache Tomcat allows an attacker to remotely trigger a … |
Vulnerable |
|
GHSA-9f3j-pm6f-9fm5
Aliases: CVE-2022-23181 |
Race condition in Apache Tomcat The fix for bug CVE-2020-9484 introduced a time of check time of use vulnerability into … |
Vulnerable |
|
GHSA-gc58-v8h3-x2gr
Aliases: CVE-2020-8022 |
Incorrect Default Permissions in Apache Tomcat ### Withdrawn As per https://lists.apache.org/thread/0z644xfjo49pn2oxcp9qslkvhhw4tb7q this issue only affects the SUSE built artifacts of … |
Vulnerable |
|
GHSA-gx5v-xp9w-j4cg
Aliases: CVE-2026-41284 |
Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 … |
Vulnerable |
|
GHSA-5mp6-jrq3-r938
Aliases: CVE-2026-43513 |
Apache Tomcat: LockOutRealm treats user names as case-sensitive Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This … |
Vulnerable |
|
GHSA-5m62-pw8w-7w9f
Aliases: CVE-2026-43515 |
Apache Tomcat - Security constraints not correctly applied Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 … |
Vulnerable |
|
GHSA-fv25-8xcx-gqjc
Aliases: CVE-2026-42498 |
Apache Tomcat - WebSocket authentication header exposure Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 Apache … |
Vulnerable |
|
GHSA-h6fc-48rj-7qqh
Aliases: CVE-2026-43512 |
Apache Tomcat - Digest authenticator will authenticate any unknown user Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 … |
Vulnerable |
|
GHSA-9m89-8frq-c98c
Aliases: CVE-2026-43514 |
Apache Tomcat - AJP secret compared in non-constant time Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to … |
Vulnerable |
|
CVE-2021-30640
|
Improper Authentication A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2021-24122
|
Information Exposure When serving resources from a network location using the NTFS file system, Apache Tomcat is susceptible to JSP … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2026-24880
Aliases: GHSA-563x-q5rq-57qp |
Apache Tomcat has an HTTP Request/Response Smuggling vulnerability Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2020-13935
Aliases: GHSA-m7jv-hq7h-mq7c |
Infinite Loop in Apache Tomcat The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-m7jv-hq7h-mq7c
Aliases: CVE-2020-13935 |
Infinite Loop in Apache Tomcat The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 … |
Vulnerable Vulnerable |
|
GHSA-9xv2-5v5q-p794
Aliases: CVE-2026-65905 |
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST … | There are no reported fixed by versions. |
|
GHSA-gcx9-497g-6cp6
Aliases: CVE-2026-65182 |
Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads … | There are no reported fixed by versions. |
|
GHSA-h3x4-894j-xpx5
Aliases: CVE-2026-68525 |
Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows … | There are no reported fixed by versions. |
|
CVE-2018-8014
|
Low: CORS filter has insecure defaults | There are no reported fixed by versions. |
|
GHSA-h468-7pvh-8vr8
Aliases: CVE-2026-29146 |
Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects … |
Vulnerable |
|
CVE-2026-65905
Aliases: GHSA-9xv2-5v5q-p794 |
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST … |
Vulnerable Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2020-1938
|
High: AJP Request Injection and potential Remote Code Execution | |
|
CVE-2020-1935
|
Low: HTTP Request Smuggling | |
|
CVE-2019-17569
|
Low: HTTP Request Smuggling | |
|
GHSA-767j-jfh2-jvrc
|
Potential HTTP request smuggling in Apache Tomcat The refactoring present in Apache Tomcat versions 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 … |
CVE-2019-17569
|
|
GHSA-qxf4-chvg-4r8r
|
Potential HTTP request smuggling in Apache Tomcat In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 … |
CVE-2020-1935
|
|
CVE-2020-1938
|
Improper Input Validation When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache … | |
|
CVE-2020-1935
|
Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) In Apache Tomcat, the HTTP header parsing code used an approach to … |