CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
1 advisories matched
2026-04-09
Apache Tomcat EncryptInterceptor Bypass and Sensitive Data Exposure Vulnerability (CVE-2026-34486)
[Affected Scope] Apache Tomcat versions 11.0.20, 10.1.53, and 9.0.116 utilizing clustering with EncryptInterceptor enabled
[Impact] Incomplete fix for CVE-2026-29146 allows attackers to bypass the EncryptInterceptor, leading to the transmission of sensitive session data in plaintext across the network
[Mitigation] Immediately upgrade to patched Apache Tomcat versions 11.0.21, 10.1.54, or 9.0.117