{"schema_version":1,"title":"org.apache.tomcat.embed:tomcat-embed-core (Maven) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 83 vulnerabilities in org.apache.tomcat.embed:tomcat-embed-core (Maven): 0 in the last 7 days and 4 in the last 90 days, 15 of them critical and 5 exploited in the wild. The most recent, CVE-2026-68525, was published on 25 August 2026. Nothing was published in the last eight weeks.","url":"https://junglewise.ai/threats/technologies/org-apache-tomcat-embed-tomcat-embed-core","json_url":"https://junglewise.ai/threats/technologies/org-apache-tomcat-embed-tomcat-embed-core.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/org-apache-tomcat-embed-tomcat-embed-core","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":20,"all_time":83,"critical":15,"exploited":5,"last_7_days":0,"last_30_days":0,"last_90_days":4,"last_365_days":23},"latest":[{"cve":"CVE-2026-68525","cvss":9.1,"epss":0.0064,"slug":"cve-2026-68525-apache-tomcat-form-authentication-authorization-bypass","title":"Apache Tomcat FORM authentication authorization bypass","severity":"critical","exploited":false,"published_at":"2026-08-25T22:17:05.7+00:00","url":"https://junglewise.ai/threats/cve-2026-68525-apache-tomcat-form-authentication-authorization-bypass"},{"cve":"CVE-2026-65905","cvss":9.8,"epss":0.0078,"slug":"cve-2026-65905-apache-tomcat-digest-authenticator-authentication-bypass","title":"Apache Tomcat DIGEST authenticator authentication bypass","severity":"critical","exploited":false,"published_at":"2026-08-25T22:17:05.303+00:00","url":"https://junglewise.ai/threats/cve-2026-65905-apache-tomcat-digest-authenticator-authentication-bypass"},{"cve":"CVE-2026-65637","cvss":9.8,"epss":0.0061,"slug":"cve-2026-65637-apache-tomcat-improper-input-validation-in-incomplete-fix","title":"Apache Tomcat improper input validation in incomplete fix","severity":"critical","exploited":false,"published_at":"2026-08-25T22:17:05.177+00:00","url":"https://junglewise.ai/threats/cve-2026-65637-apache-tomcat-improper-input-validation-in-incomplete-fix"},{"cve":"CVE-2026-65182","cvss":9.1,"epss":0.0057,"slug":"cve-2026-65182-apache-tomcat-security-constraint-bypass","title":"Apache Tomcat security constraint bypass","severity":"critical","exploited":false,"published_at":"2026-08-25T22:17:04.9+00:00","url":"https://junglewise.ai/threats/cve-2026-65182-apache-tomcat-security-constraint-bypass"},{"cve":"CVE-2026-55957","cvss":7.3,"epss":0.0286,"slug":"cve-2026-55957-apache-tomcat-authentication-bypass-in-jndirealm","title":"Apache Tomcat authentication bypass in JNDIRealm","severity":"high","exploited":false,"published_at":"2026-06-29T21:16:45.7+00:00","url":"https://junglewise.ai/threats/cve-2026-55957-apache-tomcat-authentication-bypass-in-jndirealm"},{"cve":"CVE-2026-55956","cvss":6.5,"epss":0.007,"slug":"cve-2026-55956-apache-tomcat-improper-authorization-in-default-servlet","title":"Apache Tomcat improper authorization in default servlet","severity":"medium","exploited":false,"published_at":"2026-06-29T21:16:45.597+00:00","url":"https://junglewise.ai/threats/cve-2026-55956-apache-tomcat-improper-authorization-in-default-servlet"},{"cve":"CVE-2026-55276","cvss":9.1,"epss":0.0061,"slug":"cve-2026-55276-apache-tomcat-incorrect-control-flow-in-web-xml-logging","title":"Apache Tomcat incorrect control flow in web.xml logging","severity":"critical","exploited":false,"published_at":"2026-06-29T21:16:45.38+00:00","url":"https://junglewise.ai/threats/cve-2026-55276-apache-tomcat-incorrect-control-flow-in-web-xml-logging"},{"cve":"CVE-2026-53404","cvss":7.3,"epss":0.0065,"slug":"cve-2026-53404-apache-tomcat-incorrect-control-flow-in-rewrite-valve","title":"Apache Tomcat incorrect control flow in rewrite valve","severity":"high","exploited":false,"published_at":"2026-06-29T21:16:44.527+00:00","url":"https://junglewise.ai/threats/cve-2026-53404-apache-tomcat-incorrect-control-flow-in-rewrite-valve"},{"cve":"CVE-2026-43515","cvss":9.1,"epss":0.0122,"slug":"cve-2026-43515-apache-tomcat-improper-authorization-in-security-constraints","title":"Apache Tomcat improper authorization in security constraints","severity":"critical","exploited":false,"published_at":"2026-05-12T16:16:18.553+00:00","url":"https://junglewise.ai/threats/cve-2026-43515-apache-tomcat-improper-authorization-in-security-constraints"},{"cve":"CVE-2026-43514","cvss":3.7,"epss":0.0053,"slug":"cve-2026-43514-apache-tomcat-timing-discrepancy-in-ajp-secret-comparison","title":"Apache Tomcat timing discrepancy in AJP secret comparison","severity":"low","exploited":false,"published_at":"2026-05-12T16:16:18.37+00:00","url":"https://junglewise.ai/threats/cve-2026-43514-apache-tomcat-timing-discrepancy-in-ajp-secret-comparison"},{"cve":"CVE-2026-43513","cvss":7.5,"epss":0.005,"slug":"cve-2026-43513-apache-tomcat-improper-case-sensitivity-in-lockoutrealm","title":"Apache Tomcat improper case sensitivity in LockOutRealm","severity":"high","exploited":false,"published_at":"2026-05-12T16:16:18.177+00:00","url":"https://junglewise.ai/threats/cve-2026-43513-apache-tomcat-improper-case-sensitivity-in-lockoutrealm"},{"cve":"CVE-2026-43512","cvss":9.8,"epss":0.0133,"slug":"cve-2026-43512-apache-tomcat-authentication-bypass-in-digest-authentication","title":"Apache Tomcat authentication bypass in digest authentication","severity":"critical","exploited":false,"published_at":"2026-05-12T16:16:17.99+00:00","url":"https://junglewise.ai/threats/cve-2026-43512-apache-tomcat-authentication-bypass-in-digest-authentication"},{"cve":"CVE-2026-42498","cvss":7.3,"epss":0.0065,"slug":"cve-2026-42498-apache-tomcat-authentication-header-exposure-in-websocket","title":"Apache Tomcat authentication header exposure in WebSocket authentication","severity":"high","exploited":false,"published_at":"2026-05-12T16:16:17.8+00:00","url":"https://junglewise.ai/threats/cve-2026-42498-apache-tomcat-authentication-header-exposure-in-websocket"},{"cve":"CVE-2026-41293","cvss":9.8,"epss":0.0168,"slug":"cve-2026-41293-apache-tomcat-improper-input-validation-in-http-2-request-headers","title":"Apache Tomcat improper input validation in HTTP/2 request headers","severity":"critical","exploited":false,"published_at":"2026-05-12T16:16:17.553+00:00","url":"https://junglewise.ai/threats/cve-2026-41293-apache-tomcat-improper-input-validation-in-http-2-request-headers"},{"cve":"CVE-2026-41284","cvss":7.5,"epss":0.0086,"slug":"cve-2026-41284-apache-tomcat-resource-exhaustion-in-webdav-lock-and-propfind","title":"Apache Tomcat resource exhaustion in WebDAV LOCK and PROPFIND handling","severity":"high","exploited":false,"published_at":"2026-05-12T16:16:15.933+00:00","url":"https://junglewise.ai/threats/cve-2026-41284-apache-tomcat-resource-exhaustion-in-webdav-lock-and-propfind"},{"cve":"CVE-2026-34487","cvss":7.5,"epss":0.0045,"slug":"cve-2026-34487-apache-tomcat-sensitive-information-disclosure-in-clustering","title":"Apache Tomcat sensitive information disclosure in clustering component","severity":"high","exploited":false,"published_at":"2026-04-09T20:16:25.203+00:00","url":"https://junglewise.ai/threats/cve-2026-34487-apache-tomcat-sensitive-information-disclosure-in-clustering"},{"cve":"CVE-2026-34483","cvss":7.5,"epss":0.0046,"slug":"cve-2026-34483-apache-tomcat-improper-output-escaping-in-jsonaccesslogvalve","title":"Apache Tomcat improper output escaping in JsonAccessLogValve","severity":"high","exploited":false,"published_at":"2026-04-09T20:16:24.937+00:00","url":"https://junglewise.ai/threats/cve-2026-34483-apache-tomcat-improper-output-escaping-in-jsonaccesslogvalve"},{"cve":"CVE-2026-32990","cvss":5.3,"epss":0.0031,"slug":"cve-2026-32990-apache-tomcat-improper-input-validation","title":"Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of . This issue affects Apache Tomcat: from","severity":"medium","exploited":false,"published_at":"2026-04-09T20:16:24.81+00:00","url":"https://junglewise.ai/threats/cve-2026-32990-apache-tomcat-improper-input-validation"},{"cve":"CVE-2026-29129","cvss":7.5,"epss":0.0026,"slug":"cve-2026-29129-apache-tomcat-cipher-preference-order-not-preserved","title":"Configured cipher preference order not preserved vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.16 through 11.","severity":"high","exploited":false,"published_at":"2026-04-09T20:16:24.343+00:00","url":"https://junglewise.ai/threats/cve-2026-29129-apache-tomcat-cipher-preference-order-not-preserved"},{"cve":"CVE-2026-25854","cvss":6.1,"epss":0.0053,"slug":"cve-2026-25854-apache-tomcat-open-redirect-in-loadbalancerdrainingvalve","title":"Apache Tomcat open redirect in LoadBalancerDrainingValve","severity":"medium","exploited":false,"published_at":"2026-04-09T20:16:24.207+00:00","url":"https://junglewise.ai/threats/cve-2026-25854-apache-tomcat-open-redirect-in-loadbalancerdrainingvalve"},{"cve":"CVE-2026-24880","cvss":7.5,"epss":0.007,"slug":"cve-2026-24880-apache-tomcat-http-request-smuggling-via-invalid-chunk-extension","title":"Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.","severity":"high","exploited":false,"published_at":"2026-04-09T20:16:24.06+00:00","url":"https://junglewise.ai/threats/cve-2026-24880-apache-tomcat-http-request-smuggling-via-invalid-chunk-extension"},{"cve":"CVE-2025-66614","cvss":9.1,"epss":0.0024,"slug":"cve-2025-66614-apache-tomcat-client-certificate-verification-bypass-via-sni","title":"Apache Tomcat client certificate verification bypass via SNI mismatch","severity":"critical","exploited":false,"published_at":"2026-02-17T21:31:13+00:00","url":"https://junglewise.ai/threats/cve-2025-66614-apache-tomcat-client-certificate-verification-bypass-via-sni"},{"cve":"CVE-2026-24734","cvss":7.5,"epss":0.0058,"slug":"cve-2026-24734-apache-tomcat-certificate-revocation-bypass-in-ocsp-validation","title":"Apache Tomcat certificate revocation bypass in OCSP validation","severity":"high","exploited":false,"published_at":"2026-02-17T19:21:56.953+00:00","url":"https://junglewise.ai/threats/cve-2026-24734-apache-tomcat-certificate-revocation-bypass-in-ocsp-validation"},{"cve":"CVE-2025-61795","cvss":5.3,"epss":0.0117,"slug":"cve-2025-61795-apache-tomcat-dos-via-delayed-cleanup-of-multipart-temporary","title":"Apache Tomcat DoS via delayed cleanup of multipart temporary files","severity":"medium","exploited":false,"published_at":"2025-10-27T18:15:44.2+00:00","url":"https://junglewise.ai/threats/cve-2025-61795-apache-tomcat-dos-via-delayed-cleanup-of-multipart-temporary"},{"cve":"CVE-2025-55754","cvss":9.6,"epss":0.1014,"slug":"cve-2025-55754-apache-tomcat-console-manipulation-via-ansi-escape-sequences-in","title":"Apache Tomcat console manipulation via ANSI escape sequences in logs","severity":"critical","exploited":false,"published_at":"2025-10-27T18:15:42.71+00:00","url":"https://junglewise.ai/threats/cve-2025-55754-apache-tomcat-console-manipulation-via-ansi-escape-sequences-in"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":4,"exploited":0,"vulnerabilities":4},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"org.jenkins-ci.main:jenkins-core (Maven)","slug":"org-jenkins-ci-main-jenkins-core","vulnerabilities":259,"url":"https://junglewise.ai/threats/technologies/org-jenkins-ci-main-jenkins-core"},{"name":"org.apache.tomcat:tomcat (Maven)","slug":"org-apache-tomcat-tomcat","vulnerabilities":169,"url":"https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat"},{"name":"com.liferay.portal:release.portal.bom (Maven)","slug":"com-liferay-portal-release-portal-bom","vulnerabilities":159,"url":"https://junglewise.ai/threats/technologies/com-liferay-portal-release-portal-bom"},{"name":"com.liferay.portal:release.dxp.bom (Maven)","slug":"com-liferay-portal-release-dxp-bom","vulnerabilities":125,"url":"https://junglewise.ai/threats/technologies/com-liferay-portal-release-dxp-bom"},{"name":"org.keycloak:keycloak-services (Maven)","slug":"org-keycloak-keycloak-services","vulnerabilities":122,"url":"https://junglewise.ai/threats/technologies/org-keycloak-keycloak-services"},{"name":"com.fasterxml.jackson.core:jackson-databind (Maven)","slug":"com-fasterxml-jackson-core-jackson-databind","vulnerabilities":86,"url":"https://junglewise.ai/threats/technologies/com-fasterxml-jackson-core-jackson-databind"},{"name":"org.apache.struts:struts2-core (Maven)","slug":"org-apache-struts-struts2-core","vulnerabilities":60,"url":"https://junglewise.ai/threats/technologies/org-apache-struts-struts2-core"},{"name":"org.keycloak:keycloak-core (Maven)","slug":"org-keycloak-keycloak-core","vulnerabilities":57,"url":"https://junglewise.ai/threats/technologies/org-keycloak-keycloak-core"},{"name":"org.xwiki.platform:xwiki-platform-oldcore (Maven)","slug":"org-xwiki-platform-xwiki-platform-oldcore","vulnerabilities":46,"url":"https://junglewise.ai/threats/technologies/org-xwiki-platform-xwiki-platform-oldcore"},{"name":"org.apache.tomcat:tomcat-catalina (Maven)","slug":"org-apache-tomcat-tomcat-catalina","vulnerabilities":44,"url":"https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat-catalina"},{"name":"org.elasticsearch:elasticsearch (Maven)","slug":"org-elasticsearch-elasticsearch","vulnerabilities":41,"url":"https://junglewise.ai/threats/technologies/org-elasticsearch-elasticsearch"},{"name":"io.undertow:undertow-core (Maven)","slug":"io-undertow-undertow-core","vulnerabilities":40,"url":"https://junglewise.ai/threats/technologies/io-undertow-undertow-core"}],"technology":{"hub":true,"name":"org.apache.tomcat.embed:tomcat-embed-core (Maven)","slug":"org-apache-tomcat-embed-tomcat-embed-core","vendor":{"hub":true,"name":"Maven","slug":"maven","url":"https://junglewise.ai/threats/vendors/maven"},"aliases":[],"homepage":"https://tomcat.apache.org/","repo_url":"https://github.com/apache/tomcat","description":"Embeddable Apache Tomcat servlet engine for integration into Java applications.","url":"https://junglewise.ai/threats/technologies/org-apache-tomcat-embed-tomcat-embed-core"},"most_severe":[{"cve":"CVE-2023-44487","cvss":5.3,"epss":1,"slug":"cve-2023-44487-http-2-rapid-reset-attack-vulnerability","title":"Multiple Vendors HTTP/2 denial of service via Rapid Reset attack","severity":"critical","exploited":true,"published_at":"2023-10-10T21:28:24+00:00","url":"https://junglewise.ai/threats/cve-2023-44487-http-2-rapid-reset-attack-vulnerability"},{"cve":"CVE-2025-24813","cvss":3.1,"epss":0.9993,"slug":"cve-2025-24813-apache-tomcat-path-equivalence-vulnerability","title":"Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT","severity":"critical","exploited":true,"published_at":"2025-03-10T18:31:56+00:00","url":"https://junglewise.ai/threats/cve-2025-24813-apache-tomcat-path-equivalence-vulnerability"},{"cve":"CVE-2020-1938","cvss":3.1,"epss":0.9927,"slug":"cve-2020-1938-apache-tomcat-improper-privilege-management-vulnerability","title":"Improper Privilege Management in Tomcat","severity":"critical","exploited":true,"published_at":"2020-06-15T18:51:21+00:00","url":"https://junglewise.ai/threats/cve-2020-1938-apache-tomcat-improper-privilege-management-vulnerability"},{"cve":"CVE-2017-12617","cvss":3,"epss":0.9997,"slug":"cve-2017-12617-apache-tomcat-remote-code-execution-vulnerability","title":"Unrestricted Upload of File with Dangerous Type Apache Tomcat","severity":"critical","exploited":true,"published_at":"2022-05-14T01:07:15+00:00","url":"https://junglewise.ai/threats/cve-2017-12617-apache-tomcat-remote-code-execution-vulnerability"},{"cve":"CVE-2017-12615","cvss":3,"epss":0.9964,"slug":"cve-2017-12615-apache-tomcat-on-windows-remote-code-execution-vulnerability","title":"When running Apache Tomcat on Windows with HTTP PUTs enabled it was possible to upload a JSP file to the server","severity":"critical","exploited":true,"published_at":"2018-10-17T16:30:31+00:00","url":"https://junglewise.ai/threats/cve-2017-12615-apache-tomcat-on-windows-remote-code-execution-vulnerability"},{"cve":"CVE-2026-41293","cvss":9.8,"epss":0.0168,"slug":"cve-2026-41293-apache-tomcat-improper-input-validation-in-http-2-request-headers","title":"Apache Tomcat improper input validation in HTTP/2 request headers","severity":"critical","exploited":false,"published_at":"2026-05-12T16:16:17.553+00:00","url":"https://junglewise.ai/threats/cve-2026-41293-apache-tomcat-improper-input-validation-in-http-2-request-headers"},{"cve":"CVE-2026-43512","cvss":9.8,"epss":0.0133,"slug":"cve-2026-43512-apache-tomcat-authentication-bypass-in-digest-authentication","title":"Apache Tomcat authentication bypass in digest authentication","severity":"critical","exploited":false,"published_at":"2026-05-12T16:16:17.99+00:00","url":"https://junglewise.ai/threats/cve-2026-43512-apache-tomcat-authentication-bypass-in-digest-authentication"},{"cve":"CVE-2026-65905","cvss":9.8,"epss":0.0078,"slug":"cve-2026-65905-apache-tomcat-digest-authenticator-authentication-bypass","title":"Apache Tomcat DIGEST authenticator authentication bypass","severity":"critical","exploited":false,"published_at":"2026-08-25T22:17:05.303+00:00","url":"https://junglewise.ai/threats/cve-2026-65905-apache-tomcat-digest-authenticator-authentication-bypass"},{"cve":"CVE-2026-65637","cvss":9.8,"epss":0.0061,"slug":"cve-2026-65637-apache-tomcat-improper-input-validation-in-incomplete-fix","title":"Apache Tomcat improper input validation in incomplete fix","severity":"critical","exploited":false,"published_at":"2026-08-25T22:17:05.177+00:00","url":"https://junglewise.ai/threats/cve-2026-65637-apache-tomcat-improper-input-validation-in-incomplete-fix"},{"cve":"CVE-2025-55754","cvss":9.6,"epss":0.1014,"slug":"cve-2025-55754-apache-tomcat-console-manipulation-via-ansi-escape-sequences-in","title":"Apache Tomcat console manipulation via ANSI escape sequences in logs","severity":"critical","exploited":false,"published_at":"2025-10-27T18:15:42.71+00:00","url":"https://junglewise.ai/threats/cve-2025-55754-apache-tomcat-console-manipulation-via-ansi-escape-sequences-in"}],"generated_at":"2026-11-09T03:07:00.176479+00:00"}