Search for packages
| purl | pkg:maven/org.apache.tomcat/tomcat@9.0.123 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2018-8014
|
Low: CORS filter has insecure defaults |
Vulnerable Vulnerable |
|
CVE-2016-6797
|
Low: Unrestricted Access to Global Resources |
Vulnerable |
|
CVE-2016-6796
|
Low: Security Manager Bypass |
Vulnerable |
|
CVE-2016-6794
|
Low: System Property Disclosure |
Vulnerable |
|
CVE-2016-5018
|
Low: Security Manager Bypass |
Vulnerable |
|
CVE-2016-0762
|
Low: Timing Attack |
Vulnerable |
|
CVE-2016-3092
|
Moderate: Denial of Service |
Vulnerable |
|
CVE-2013-4286
|
Important: Information disclosure | There are no reported fixed by versions. |
|
CVE-2018-8014
|
Low: CORS filter has insecure defaults | There are no reported fixed by versions. |
|
CVE-2026-66299
|
Low: DoS in WebSocket chat example |
Vulnerable |
|
CVE-2018-8014
|
Low: CORS filter has insecure defaults | There are no reported fixed by versions. |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2026-101356
|
Important: HTTP/2 request/response mix-up after error during async processing | |
|
CVE-2026-101296
|
Important: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms | |
|
CVE-2026-93446
|
Low: Possible TLS 1.3 connection failures | |
|
CVE-2026-88041
|
Low: HTTP/2 trailer header cross-contamination | |
|
CVE-2026-80353
|
Low: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector | |
|
CVE-2026-74049
|
Low: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE) | |
|
CVE-2026-74048
|
Low: OpenSSL-FFM FIPS failure does not prevent start-up |