Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Apache Tomcat 7.0.0 Clear all filters
TI-2026-40363 CVE-2026-55957 · GHSA-7895-gffq-w6jq

Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind

Priority MEDIUM 45

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.02855 Published 2026-06-29 Partial fix · 11.0.5, 10.1.37 +1 CWE-304
TI-2026-40362 CVE-2026-55956 · GHSA-5v3h-fjv2-54fg

Apache Tomcat: Security constraints for default servlet ignored method

Priority LOW 36

Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00695 Published 2026-06-29 Partial fix · 11.0.23, 10.1.56 +1 CWE-285
TI-2026-36982 CVE-2026-50229 · GHSA-pg42-rg8c-j886

Apache Tomcat: XSS in number guess example

Priority LOW 34

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.04091 Published 2026-06-29 Partial fix · 11.0.23, 10.1.56 +1 CWE-80