CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Apache Tomcat EncryptInterceptor Padding Oracle Vulnerability (CVE-2026-29146) Security Advisory
[Affected Scope] Apache Tomcat deployments utilizing `EncryptInterceptor` with default configurations for cluster membership protection (11.0.0-M1 to 11.0.18, 10.0.0-M1 to 10.1.52, 9.0.13 to 9.0.115, 8.5.38 to 8.5.100, 7.0.100 to 7.0.109).
[Impact] Remote attackers can intercept encrypted cluster traffic and perform a padding oracle attack to decrypt sensitive session data or cluster control messages without knowing the encryption key.
[Mitigation] Upgrade to fixed versions (11.0.19, 10.1.53, or 9.0.116) immediately, or configure the EncryptInterceptor to use secure authenticated encryption (e.g., GCM mode).
Wing FTP Server Information Disclosure Vulnerability (CVE-2025-47813) - Full Installation Path Leakage Advisory
[Affected Scope] All Wing FTP Server installations running versions prior to 7.4.4
[Impact] Attackers can disclose the full local installation path of the application by supplying an excessively long value in the UID cookie, facilitating subsequent targeted attacks
[Mitigation] Immediately upgrade Wing FTP Server to version 7.4.4 or later, and deploy WAF rules to restrict anomalous cookie lengths in the interim