Known vulnerabilities in Apache Tomcat

Software: Apache Tomcat
Software CPE: cpe:2.3:a:apache_foundation:apache_tomcat:*:*:*:*:*:*:*:*
Total vulnerabilities: 163
Public exploits: 29
Known exploited (KEV): 8
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Apache Tomcat Apache Tomcat is affected by 163 known vulnerabilities: 1 critical, 11 high, 98 medium, 53 low Critical High Medium Low

Vulnerabilities (163)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU151838 - Improper input validation
CVE-2026-87022
CWE-20 Medium
No
No
9.0.122, 10.1.60, 11.0.26 23.09.2026 SB2026092344
SB2026100975
SB2026100977
#VU151839 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVE-2026-86350
CWE-444 Medium
No
No
9.0.122, 10.1.60, 11.0.26 23.09.2026 SB2026092344
SB2026100975
SB2026100977
and 1 more
#VU151840 - Improper Certificate Validation
CVE-2026-86248
CWE-295 Medium
No
No
9.0.122, 10.1.60, 11.0.26 23.09.2026 SB2026092344
SB2026100975
SB2026100977
#VU151841 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2026-79677
CWE-362 Medium
No
No
9.0.122, 10.1.60, 11.0.26 23.09.2026 SB2026092344
SB2026100975
SB2026100977
and 1 more
#VU151842 - Resource exhaustion
CVE-2026-78437
CWE-400 Low
No
No
9.0.122, 10.1.60, 11.0.26 23.09.2026 SB2026092344
SB2026100975
SB2026100977
and 1 more
#VU151843 - Resource exhaustion
CVE-2026-78383
CWE-400 Medium
No
No
9.0.122, 10.1.60, 11.0.26 23.09.2026 SB2026092344
SB2026100975
SB2026100977
and 1 more
#VU151844 - Resource exhaustion
CVE-2026-77791
CWE-400 Medium
No
No
9.0.122, 10.1.60, 11.0.26 23.09.2026 SB2026092344
SB2026100975
SB2026100977
and 1 more
#VU151845 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2026-77762
CWE-362 Low
No
No
9.0.122, 10.1.60, 11.0.26 23.09.2026 SB2026092344
SB2026100975
SB2026100977
and 1 more
#VU151846 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVE-2026-77756
CWE-444 Low
No
No
9.0.122, 10.1.60, 11.0.26 23.09.2026 SB2026092344
SB2026100975
SB2026100977
and 1 more
#VU151847 - Improper Access Control
CVE-2026-76183
CWE-284 Medium
No
No
9.0.122, 10.1.60, 11.0.26 23.09.2026 SB2026092344
SB2026100975
SB2026100977
and 1 more
#VU151848 - Improper Authentication
CVE-2026-75973
CWE-287 Low
No
No
9.0.122, 10.1.60, 11.0.26 23.09.2026 SB2026092344
SB2026100975
SB2026100977
#VU151849 - Improper Certificate Validation
CVE-2026-73581
CWE-295 Medium
No
No
9.0.122, 10.1.60, 11.0.26 23.09.2026 SB2026092344
SB2026100975
SB2026100977
and 1 more
#VU145386 - Improper Authentication
CVE-2026-68569
CWE-287 Low
No
No
9.0.121, 10.1.59, 11.0.25 26.08.2026 SB2026082616
SB20260921191
SB20260921206
and 1 more
#VU145385 - Improper Access Control
CVE-2026-68525
CWE-284 Low
No
No
9.0.121, 10.1.59, 11.0.25 26.08.2026 SB2026082616
SB20260921191
SB20260921206
and 1 more
#VU145384 - Improper Access Control
CVE-2026-66422
CWE-284 Low
No
No
9.0.121, 10.1.59, 11.0.25 26.08.2026 SB2026082616
SB20260921191
SB20260921206
and 1 more
#VU145383 - Off-by-one Error
CVE-2026-65927
CWE-193 Medium
No
No
9.0.121, 10.1.59, 11.0.25 26.08.2026 SB2026082616
SB20260921191
SB20260921206
and 1 more
#VU145382 - Authentication Bypass by Capture-replay
CVE-2026-65905
CWE-294 Low
No
No
9.0.121, 10.1.59, 11.0.25 26.08.2026 SB2026082616
SB20260921191
SB20260921206
and 1 more
#VU145381 - Improper Access Control
CVE-2026-65637
CWE-284 Medium
No
No
9.0.121, 10.1.59, 11.0.25 26.08.2026 SB2026082616
SB20260921191
SB20260921206
and 1 more
#VU145380 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVE-2026-65183
CWE-367 Low
No
No
9.0.121, 10.1.59, 11.0.25 26.08.2026 SB2026082616
SB20260921191
SB20260921206
and 1 more
#VU145379 - Improper Access Control
CVE-2026-65182
CWE-284 Medium
No
No
9.0.121, 10.1.59, 11.0.25 26.08.2026 SB2026082616
SB20260921191
SB20260921206
and 1 more


Showing elements 1 - 20 out of 163