CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Apache Tomcat EncryptInterceptor Bypass and Sensitive Data Exposure Vulnerability (CVE-2026-34486)
[Affected Scope] Apache Tomcat versions 11.0.20, 10.1.53, and 9.0.116 utilizing clustering with EncryptInterceptor enabled
[Impact] Incomplete fix for CVE-2026-29146 allows attackers to bypass the EncryptInterceptor, leading to the transmission of sensitive session data in plaintext across the network
[Mitigation] Immediately upgrade to patched Apache Tomcat versions 11.0.21, 10.1.54, or 9.0.117
Apache Tomcat Default Servlet Path Equivalence Vulnerability Leading to Remote Code Execution and Information Disclosure (CVE-2025-24813)
[Affected Scope] Apache Tomcat versions 11.0.0-M1 through 11.0.2, 10.1.0-M1 through 10.1.34, 9.0.0.M1 through 9.0.98, and EOL 8.5.0 through 8.5.100.
[Impact] Attackers can bypass path validation via internal dot path equivalence, allowing them to inject malicious content into sensitive files or trigger remote code execution (RCE) via session deserialization.
[Mitigation] Immediately upgrade to patched versions (11.0.3, 10.1.35, or 9.0.99) and ensure the Default Servlet's 'readonly' parameter is set to 'true'.
Apache Tomcat AJP Connector File Read and Remote Code Execution Vulnerability (Ghostcat, CVE-2020-1938)
[Affected Scope] Apache Tomcat versions 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50, and 7.0.0 to 7.0.99
[Impact] Attackers with access to the AJP port (default 8009) can read arbitrary files from the web application or execute arbitrary code (RCE) if file upload is permitted
[Mitigation] Upgrade to Apache Tomcat 9.0.31, 8.5.51, 7.0.100 or later, or disable/restrict the AJP Connector in the configuration
Apache Tomcat Remote Code Execution Vulnerability via DefaultServlet readonly Parameter Misconfiguration (CVE-2017-12617)
[Affected Scope] Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46, and 7.0.0 to 7.0.81 when the 'readonly' parameter of the DefaultServlet is set to false
[Impact] Unauthenticated remote attackers can upload malicious JSP files using crafted HTTP PUT requests, leading to arbitrary code execution with the privileges of the Tomcat process
[Mitigation] Upgrade Apache Tomcat to the latest secure versions, or modify the web.xml configuration to ensure the 'readonly' parameter is set to true (default)
Apache Tomcat 7.0.x Windows Remote Code Execution Vulnerability (CVE-2017-12615) Security Advisory
[Affected Scope] Apache Tomcat versions 7.0.0 to 7.0.79 running on Windows with the 'readonly' initialization parameter set to 'false'.
[Impact] Unauthenticated remote attackers can upload malicious JSP files via specially crafted HTTP PUT requests, leading to arbitrary code execution under the context of the Tomcat process.
[Mitigation] Immediately upgrade Apache Tomcat to version 7.0.81 or later, or revert the 'readonly' parameter to 'true' in the web.xml configuration.
Apache Tomcat JmxRemoteLifecycleListener Deserialization Remote Code Execution Vulnerability Analysis and Mitigation Guide (CVE-2016-8735)
[Affected Scope] Apache Tomcat versions before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12, when JmxRemoteLifecycleListener is enabled
[Impact] Remote attackers with network access to JMX ports can trigger untrusted deserialization without authentication, leading to arbitrary Remote Code Execution (RCE) with system privileges
[Mitigation] Upgrade Apache Tomcat to the latest secure release, or disable JmxRemoteLifecycleListener in server.xml and restrict network access to JMX ports using firewalls