CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Apache Tomcat Default Servlet Path Equivalence Vulnerability Leading to Remote Code Execution and Information Disclosure (CVE-2025-24813)
[Affected Scope] Apache Tomcat versions 11.0.0-M1 through 11.0.2, 10.1.0-M1 through 10.1.34, 9.0.0.M1 through 9.0.98, and EOL 8.5.0 through 8.5.100.
[Impact] Attackers can bypass path validation via internal dot path equivalence, allowing them to inject malicious content into sensitive files or trigger remote code execution (RCE) via session deserialization.
[Mitigation] Immediately upgrade to patched versions (11.0.3, 10.1.35, or 9.0.99) and ensure the Default Servlet's 'readonly' parameter is set to 'true'.
Apache Tomcat AJP Connector File Read and Remote Code Execution Vulnerability (Ghostcat, CVE-2020-1938)
[Affected Scope] Apache Tomcat versions 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50, and 7.0.0 to 7.0.99
[Impact] Attackers with access to the AJP port (default 8009) can read arbitrary files from the web application or execute arbitrary code (RCE) if file upload is permitted
[Mitigation] Upgrade to Apache Tomcat 9.0.31, 8.5.51, 7.0.100 or later, or disable/restrict the AJP Connector in the configuration
Apache Tomcat JmxRemoteLifecycleListener Deserialization Remote Code Execution Vulnerability Analysis and Mitigation Guide (CVE-2016-8735)
[Affected Scope] Apache Tomcat versions before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12, when JmxRemoteLifecycleListener is enabled
[Impact] Remote attackers with network access to JMX ports can trigger untrusted deserialization without authentication, leading to arbitrary Remote Code Execution (RCE) with system privileges
[Mitigation] Upgrade Apache Tomcat to the latest secure release, or disable JmxRemoteLifecycleListener in server.xml and restrict network access to JMX ports using firewalls