{"schema_version":1,"title":"org.apache.tomcat:tomcat-catalina (Maven) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 44 vulnerabilities in org.apache.tomcat:tomcat-catalina (Maven): 0 in the last 7 days and 3 in the last 90 days, 9 of them critical and 3 exploited in the wild. The most recent, CVE-2026-68525, was published on 25 August 2026. Nothing was published in the last eight weeks.","url":"https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat-catalina","json_url":"https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat-catalina.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat-catalina","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":10,"all_time":44,"critical":9,"exploited":3,"last_7_days":0,"last_30_days":0,"last_90_days":3,"last_365_days":14},"latest":[{"cve":"CVE-2026-68525","cvss":9.1,"epss":0.0064,"slug":"cve-2026-68525-apache-tomcat-form-authentication-authorization-bypass","title":"Apache Tomcat FORM authentication authorization bypass","severity":"critical","exploited":false,"published_at":"2026-08-25T22:17:05.7+00:00","url":"https://junglewise.ai/threats/cve-2026-68525-apache-tomcat-form-authentication-authorization-bypass"},{"cve":"CVE-2026-65905","cvss":9.8,"epss":0.0078,"slug":"cve-2026-65905-apache-tomcat-digest-authenticator-authentication-bypass","title":"Apache Tomcat DIGEST authenticator authentication bypass","severity":"critical","exploited":false,"published_at":"2026-08-25T22:17:05.303+00:00","url":"https://junglewise.ai/threats/cve-2026-65905-apache-tomcat-digest-authenticator-authentication-bypass"},{"cve":"CVE-2026-65182","cvss":9.1,"epss":0.0057,"slug":"cve-2026-65182-apache-tomcat-security-constraint-bypass","title":"Apache Tomcat security constraint bypass","severity":"critical","exploited":false,"published_at":"2026-08-25T22:17:04.9+00:00","url":"https://junglewise.ai/threats/cve-2026-65182-apache-tomcat-security-constraint-bypass"},{"cve":"CVE-2026-55957","cvss":7.3,"epss":0.0286,"slug":"cve-2026-55957-apache-tomcat-authentication-bypass-in-jndirealm","title":"Apache Tomcat authentication bypass in JNDIRealm","severity":"high","exploited":false,"published_at":"2026-06-29T21:16:45.7+00:00","url":"https://junglewise.ai/threats/cve-2026-55957-apache-tomcat-authentication-bypass-in-jndirealm"},{"cve":"CVE-2026-55956","cvss":6.5,"epss":0.007,"slug":"cve-2026-55956-apache-tomcat-improper-authorization-in-default-servlet","title":"Apache Tomcat improper authorization in default servlet","severity":"medium","exploited":false,"published_at":"2026-06-29T21:16:45.597+00:00","url":"https://junglewise.ai/threats/cve-2026-55956-apache-tomcat-improper-authorization-in-default-servlet"},{"cve":"CVE-2026-53404","cvss":7.3,"epss":0.0065,"slug":"cve-2026-53404-apache-tomcat-incorrect-control-flow-in-rewrite-valve","title":"Apache Tomcat incorrect control flow in rewrite valve","severity":"high","exploited":false,"published_at":"2026-06-29T21:16:44.527+00:00","url":"https://junglewise.ai/threats/cve-2026-53404-apache-tomcat-incorrect-control-flow-in-rewrite-valve"},{"cve":"CVE-2026-43515","cvss":9.1,"epss":0.0122,"slug":"cve-2026-43515-apache-tomcat-improper-authorization-in-security-constraints","title":"Apache Tomcat improper authorization in security constraints","severity":"critical","exploited":false,"published_at":"2026-05-12T16:16:18.553+00:00","url":"https://junglewise.ai/threats/cve-2026-43515-apache-tomcat-improper-authorization-in-security-constraints"},{"cve":"CVE-2026-43514","cvss":3.7,"epss":0.0053,"slug":"cve-2026-43514-apache-tomcat-timing-discrepancy-in-ajp-secret-comparison","title":"Apache Tomcat timing discrepancy in AJP secret comparison","severity":"low","exploited":false,"published_at":"2026-05-12T16:16:18.37+00:00","url":"https://junglewise.ai/threats/cve-2026-43514-apache-tomcat-timing-discrepancy-in-ajp-secret-comparison"},{"cve":"CVE-2026-43513","cvss":7.5,"epss":0.005,"slug":"cve-2026-43513-apache-tomcat-improper-case-sensitivity-in-lockoutrealm","title":"Apache Tomcat improper case sensitivity in LockOutRealm","severity":"high","exploited":false,"published_at":"2026-05-12T16:16:18.177+00:00","url":"https://junglewise.ai/threats/cve-2026-43513-apache-tomcat-improper-case-sensitivity-in-lockoutrealm"},{"cve":"CVE-2026-43512","cvss":9.8,"epss":0.0133,"slug":"cve-2026-43512-apache-tomcat-authentication-bypass-in-digest-authentication","title":"Apache Tomcat authentication bypass in digest authentication","severity":"critical","exploited":false,"published_at":"2026-05-12T16:16:17.99+00:00","url":"https://junglewise.ai/threats/cve-2026-43512-apache-tomcat-authentication-bypass-in-digest-authentication"},{"cve":"CVE-2026-42498","cvss":7.3,"epss":0.0065,"slug":"cve-2026-42498-apache-tomcat-authentication-header-exposure-in-websocket","title":"Apache Tomcat authentication header exposure in WebSocket authentication","severity":"high","exploited":false,"published_at":"2026-05-12T16:16:17.8+00:00","url":"https://junglewise.ai/threats/cve-2026-42498-apache-tomcat-authentication-header-exposure-in-websocket"},{"cve":"CVE-2026-41284","cvss":7.5,"epss":0.0086,"slug":"cve-2026-41284-apache-tomcat-resource-exhaustion-in-webdav-lock-and-propfind","title":"Apache Tomcat resource exhaustion in WebDAV LOCK and PROPFIND handling","severity":"high","exploited":false,"published_at":"2026-05-12T16:16:15.933+00:00","url":"https://junglewise.ai/threats/cve-2026-41284-apache-tomcat-resource-exhaustion-in-webdav-lock-and-propfind"},{"cve":"CVE-2026-34483","cvss":7.5,"epss":0.0046,"slug":"cve-2026-34483-apache-tomcat-improper-output-escaping-in-jsonaccesslogvalve","title":"Apache Tomcat improper output escaping in JsonAccessLogValve","severity":"high","exploited":false,"published_at":"2026-04-09T20:16:24.937+00:00","url":"https://junglewise.ai/threats/cve-2026-34483-apache-tomcat-improper-output-escaping-in-jsonaccesslogvalve"},{"cve":"CVE-2026-25854","cvss":6.1,"epss":0.0053,"slug":"cve-2026-25854-apache-tomcat-open-redirect-in-loadbalancerdrainingvalve","title":"Apache Tomcat open redirect in LoadBalancerDrainingValve","severity":"medium","exploited":false,"published_at":"2026-04-09T20:16:24.207+00:00","url":"https://junglewise.ai/threats/cve-2026-25854-apache-tomcat-open-redirect-in-loadbalancerdrainingvalve"},{"cve":"CVE-2025-61795","cvss":5.3,"epss":0.0117,"slug":"cve-2025-61795-apache-tomcat-dos-via-delayed-cleanup-of-multipart-temporary","title":"Apache Tomcat DoS via delayed cleanup of multipart temporary files","severity":"medium","exploited":false,"published_at":"2025-10-27T18:15:44.2+00:00","url":"https://junglewise.ai/threats/cve-2025-61795-apache-tomcat-dos-via-delayed-cleanup-of-multipart-temporary"},{"cve":"CVE-2025-55754","cvss":9.6,"epss":0.1014,"slug":"cve-2025-55754-apache-tomcat-console-manipulation-via-ansi-escape-sequences-in","title":"Apache Tomcat console manipulation via ANSI escape sequences in logs","severity":"critical","exploited":false,"published_at":"2025-10-27T18:15:42.71+00:00","url":"https://junglewise.ai/threats/cve-2025-55754-apache-tomcat-console-manipulation-via-ansi-escape-sequences-in"},{"cve":"CVE-2025-55752","cvss":7.5,"epss":0.6654,"slug":"cve-2025-55752-apache-tomcat-relative-path-traversal-in-url-rewrite","title":"Apache Tomcat relative path traversal in URL rewrite normalization","severity":"high","exploited":false,"published_at":"2025-10-27T18:15:42.283+00:00","url":"https://junglewise.ai/threats/cve-2025-55752-apache-tomcat-relative-path-traversal-in-url-rewrite"},{"cve":"CVE-2025-55668","cvss":6.5,"epss":0.0086,"slug":"cve-2025-55668-apache-tomcat-session-fixation-in-rewrite-valve","title":"Apache Tomcat session fixation in rewrite valve","severity":"medium","exploited":false,"published_at":"2025-08-13T15:30:34+00:00","url":"https://junglewise.ai/threats/cve-2025-55668-apache-tomcat-session-fixation-in-rewrite-valve"},{"cve":"CVE-2025-52520","cvss":3.1,"epss":0.0206,"slug":"cve-2025-52520-apache-tomcat-catalina-is-vulnerable-to-dos-attack-through","title":"Apache Tomcat Catalina is vulnerable to DoS attack through bypassing of size limits","severity":"low","exploited":false,"published_at":"2025-07-10T21:31:52+00:00","url":"https://junglewise.ai/threats/cve-2025-52520-apache-tomcat-catalina-is-vulnerable-to-dos-attack-through"},{"cve":"CVE-2025-49125","cvss":4,"epss":0.0344,"slug":"cve-2025-49125-apache-tomcat-security-constraint-bypass-for-pre-post-resources","title":"Apache Tomcat - Security constraint bypass for pre/post-resources","severity":"medium","exploited":false,"published_at":"2025-06-16T15:32:28+00:00","url":"https://junglewise.ai/threats/cve-2025-49125-apache-tomcat-security-constraint-bypass-for-pre-post-resources"},{"cve":"CVE-2025-49124","cvss":4,"epss":0.0036,"slug":"cve-2025-49124-apache-tomcat-installer-for-windows-has-an-untrusted-search-path","title":"Apache Tomcat installer for Windows has an untrusted search path vulnerability","severity":"medium","exploited":false,"published_at":"2025-06-16T15:32:28+00:00","url":"https://junglewise.ai/threats/cve-2025-49124-apache-tomcat-installer-for-windows-has-an-untrusted-search-path"},{"cve":"CVE-2025-48988","cvss":3.1,"epss":0.3052,"slug":"cve-2025-48988-apache-tomcat-dos-in-multipart-upload","title":"Apache Tomcat - DoS in multipart upload","severity":"low","exploited":false,"published_at":"2025-06-16T15:32:28+00:00","url":"https://junglewise.ai/threats/cve-2025-48988-apache-tomcat-dos-in-multipart-upload"},{"cve":"CVE-2025-46701","cvss":4,"epss":0.0293,"slug":"cve-2025-46701-apache-tomcat-cgi-security-constraint-bypass","title":"Apache Tomcat - CGI security constraint bypass","severity":"medium","exploited":false,"published_at":"2025-05-29T21:31:37+00:00","url":"https://junglewise.ai/threats/cve-2025-46701-apache-tomcat-cgi-security-constraint-bypass"},{"cve":"CVE-2025-31651","cvss":4,"epss":0.0419,"slug":"cve-2025-31651-apache-tomcat-rewrite-rule-bypass","title":"Apache Tomcat Rewrite rule bypass","severity":"medium","exploited":false,"published_at":"2025-04-28T21:30:43+00:00","url":"https://junglewise.ai/threats/cve-2025-31651-apache-tomcat-rewrite-rule-bypass"},{"cve":"CVE-2025-24813","cvss":3.1,"epss":0.9993,"slug":"cve-2025-24813-apache-tomcat-path-equivalence-vulnerability","title":"Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT","severity":"critical","exploited":true,"published_at":"2025-03-10T18:31:56+00:00","url":"https://junglewise.ai/threats/cve-2025-24813-apache-tomcat-path-equivalence-vulnerability"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":3,"exploited":0,"vulnerabilities":3},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"org.jenkins-ci.main:jenkins-core (Maven)","slug":"org-jenkins-ci-main-jenkins-core","vulnerabilities":259,"url":"https://junglewise.ai/threats/technologies/org-jenkins-ci-main-jenkins-core"},{"name":"org.apache.tomcat:tomcat (Maven)","slug":"org-apache-tomcat-tomcat","vulnerabilities":169,"url":"https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat"},{"name":"com.liferay.portal:release.portal.bom (Maven)","slug":"com-liferay-portal-release-portal-bom","vulnerabilities":159,"url":"https://junglewise.ai/threats/technologies/com-liferay-portal-release-portal-bom"},{"name":"com.liferay.portal:release.dxp.bom (Maven)","slug":"com-liferay-portal-release-dxp-bom","vulnerabilities":125,"url":"https://junglewise.ai/threats/technologies/com-liferay-portal-release-dxp-bom"},{"name":"org.keycloak:keycloak-services (Maven)","slug":"org-keycloak-keycloak-services","vulnerabilities":122,"url":"https://junglewise.ai/threats/technologies/org-keycloak-keycloak-services"},{"name":"com.fasterxml.jackson.core:jackson-databind (Maven)","slug":"com-fasterxml-jackson-core-jackson-databind","vulnerabilities":86,"url":"https://junglewise.ai/threats/technologies/com-fasterxml-jackson-core-jackson-databind"},{"name":"org.apache.tomcat.embed:tomcat-embed-core (Maven)","slug":"org-apache-tomcat-embed-tomcat-embed-core","vulnerabilities":83,"url":"https://junglewise.ai/threats/technologies/org-apache-tomcat-embed-tomcat-embed-core"},{"name":"org.apache.struts:struts2-core (Maven)","slug":"org-apache-struts-struts2-core","vulnerabilities":60,"url":"https://junglewise.ai/threats/technologies/org-apache-struts-struts2-core"},{"name":"org.keycloak:keycloak-core (Maven)","slug":"org-keycloak-keycloak-core","vulnerabilities":57,"url":"https://junglewise.ai/threats/technologies/org-keycloak-keycloak-core"},{"name":"org.xwiki.platform:xwiki-platform-oldcore (Maven)","slug":"org-xwiki-platform-xwiki-platform-oldcore","vulnerabilities":46,"url":"https://junglewise.ai/threats/technologies/org-xwiki-platform-xwiki-platform-oldcore"},{"name":"org.elasticsearch:elasticsearch (Maven)","slug":"org-elasticsearch-elasticsearch","vulnerabilities":41,"url":"https://junglewise.ai/threats/technologies/org-elasticsearch-elasticsearch"},{"name":"io.undertow:undertow-core (Maven)","slug":"io-undertow-undertow-core","vulnerabilities":40,"url":"https://junglewise.ai/threats/technologies/io-undertow-undertow-core"}],"technology":{"hub":true,"name":"org.apache.tomcat:tomcat-catalina (Maven)","slug":"org-apache-tomcat-tomcat-catalina","vendor":{"hub":true,"name":"Maven","slug":"maven","url":"https://junglewise.ai/threats/vendors/maven"},"aliases":[],"homepage":"https://tomcat.apache.org/","repo_url":"https://github.com/apache/tomcat","description":"Apache Tomcat servlet container component for processing HTTP requests and managing web applications.","url":"https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat-catalina"},"most_severe":[{"cve":"CVE-2025-24813","cvss":3.1,"epss":0.9993,"slug":"cve-2025-24813-apache-tomcat-path-equivalence-vulnerability","title":"Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT","severity":"critical","exploited":true,"published_at":"2025-03-10T18:31:56+00:00","url":"https://junglewise.ai/threats/cve-2025-24813-apache-tomcat-path-equivalence-vulnerability"},{"cve":"CVE-2017-12617","cvss":3,"epss":0.9997,"slug":"cve-2017-12617-apache-tomcat-remote-code-execution-vulnerability","title":"Unrestricted Upload of File with Dangerous Type Apache Tomcat","severity":"critical","exploited":true,"published_at":"2022-05-14T01:07:15+00:00","url":"https://junglewise.ai/threats/cve-2017-12617-apache-tomcat-remote-code-execution-vulnerability"},{"cve":"CVE-2016-8735","cvss":3,"epss":0.9034,"slug":"cve-2016-8735-apache-tomcat-remote-code-execution-vulnerability","title":"Apache Tomcat Improper Access Control vulnerability","severity":"critical","exploited":true,"published_at":"2022-05-13T01:14:52+00:00","url":"https://junglewise.ai/threats/cve-2016-8735-apache-tomcat-remote-code-execution-vulnerability"},{"cve":"CVE-2026-43512","cvss":9.8,"epss":0.0133,"slug":"cve-2026-43512-apache-tomcat-authentication-bypass-in-digest-authentication","title":"Apache Tomcat authentication bypass in digest authentication","severity":"critical","exploited":false,"published_at":"2026-05-12T16:16:17.99+00:00","url":"https://junglewise.ai/threats/cve-2026-43512-apache-tomcat-authentication-bypass-in-digest-authentication"},{"cve":"CVE-2026-65905","cvss":9.8,"epss":0.0078,"slug":"cve-2026-65905-apache-tomcat-digest-authenticator-authentication-bypass","title":"Apache Tomcat DIGEST authenticator authentication bypass","severity":"critical","exploited":false,"published_at":"2026-08-25T22:17:05.303+00:00","url":"https://junglewise.ai/threats/cve-2026-65905-apache-tomcat-digest-authenticator-authentication-bypass"},{"cve":"CVE-2025-55754","cvss":9.6,"epss":0.1014,"slug":"cve-2025-55754-apache-tomcat-console-manipulation-via-ansi-escape-sequences-in","title":"Apache Tomcat console manipulation via ANSI escape sequences in logs","severity":"critical","exploited":false,"published_at":"2025-10-27T18:15:42.71+00:00","url":"https://junglewise.ai/threats/cve-2025-55754-apache-tomcat-console-manipulation-via-ansi-escape-sequences-in"},{"cve":"CVE-2026-43515","cvss":9.1,"epss":0.0122,"slug":"cve-2026-43515-apache-tomcat-improper-authorization-in-security-constraints","title":"Apache Tomcat improper authorization in security constraints","severity":"critical","exploited":false,"published_at":"2026-05-12T16:16:18.553+00:00","url":"https://junglewise.ai/threats/cve-2026-43515-apache-tomcat-improper-authorization-in-security-constraints"},{"cve":"CVE-2026-68525","cvss":9.1,"epss":0.0064,"slug":"cve-2026-68525-apache-tomcat-form-authentication-authorization-bypass","title":"Apache Tomcat FORM authentication authorization bypass","severity":"critical","exploited":false,"published_at":"2026-08-25T22:17:05.7+00:00","url":"https://junglewise.ai/threats/cve-2026-68525-apache-tomcat-form-authentication-authorization-bypass"},{"cve":"CVE-2026-65182","cvss":9.1,"epss":0.0057,"slug":"cve-2026-65182-apache-tomcat-security-constraint-bypass","title":"Apache Tomcat security constraint bypass","severity":"critical","exploited":false,"published_at":"2026-08-25T22:17:04.9+00:00","url":"https://junglewise.ai/threats/cve-2026-65182-apache-tomcat-security-constraint-bypass"},{"cve":"CVE-2025-55752","cvss":7.5,"epss":0.6654,"slug":"cve-2025-55752-apache-tomcat-relative-path-traversal-in-url-rewrite","title":"Apache Tomcat relative path traversal in URL rewrite normalization","severity":"high","exploited":false,"published_at":"2025-10-27T18:15:42.283+00:00","url":"https://junglewise.ai/threats/cve-2025-55752-apache-tomcat-relative-path-traversal-in-url-rewrite"}],"generated_at":"2026-11-09T03:07:00.176479+00:00"}