https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T17:16:55.861848+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2023:6570 ALSA-2023:6570 — Moderate: tomcat security and bug fix update 2026-10-02T17:16:56.219742+00:00

Affected: AlmaLinux:9: tomcat, AlmaLinux:9: tomcat-admin-webapps, AlmaLinux:9: tomcat-docs-webapp, AlmaLinux:9: tomcat-el-3.0-api, AlmaLinux:9: tomcat-jsp-2.3-api, AlmaLinux:9: tomcat-lib, AlmaLinux:9: tomcat-servlet-4.0-api, AlmaLinux:9: tomcat-webapps

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

* Apache Commons FileUpload: FileUpload DoS with excessive parts (CVE-2023-24998) * tomcat: not including the secure attribute causes information disclosure (CVE-2023-28708) * tomcat: Fix for CVE-2023-24998 was incomplete (CVE-2023-28709)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

 https://cve.radiocsirt.org/vuln/bdu:2025-10838 bdu:2025-10838 2026-10-02T17:16:56.219829+00:00 bdu:2025-10838 https://cve.radiocsirt.org/vuln/bit-tomcat-2023-28708 BIT-tomcat-2023-28708 — Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations 2026-10-02T17:16:56.219847+00:00

Affected: Bitnami: tomcat

When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 10.1.0 to 10.1.5, 9.0.0 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.

Older, EOL versions may also be affected.

 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0253 certfr-2023-avi-0253 — Une vulnérabilité a été découverte dans Apache Tomcat. Elle permet à un attaquant de provoquer une atteinte à la confid… 2026-10-02T17:16:56.219872+00:00 certfr-2023-avi-0253 https://cve.radiocsirt.org/vuln/cleanstart-2026-aj47488 Withdrawn: CLEANSTART-2026-AJ47488 — When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Prot… 2026-10-02T17:16:56.219888+00:00

Withdrawn by the publisher.

Affected: CleanStart: tomcat10

Multiple security vulnerabilities affect the tomcat10 package. When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-259638 EUVD-2026-259638 2026-10-02T17:16:56.219911+00:00 EUVD-2026-259638 https://cve.radiocsirt.org/vuln/fkie_cve-2023-28708 fkie_cve-2023-28708 2026-10-02T17:16:56.219924+00:00

When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.

Older, EOL versions may also be affected.

 https://cve.radiocsirt.org/vuln/ghsa-2c9m-w27f-53rm GHSA-2c9m-w27f-53rm — Apache Tomcat vulnerable to Unprotected Transport of Credentials 2026-10-02T17:16:56.219949+00:00

Affected: Maven: org.apache.tomcat:tomcat-catalina

When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.

 https://cve.radiocsirt.org/vuln/gsd-2023-28708 gsd-2023-28708 2026-10-02T17:16:56.219974+00:00 gsd-2023-28708 https://cve.radiocsirt.org/vuln/oesa-2023-1247 OESA-2023-1247 — tomcat security update 2026-10-02T17:16:56.219986+00:00

Affected: openEuler:20.03-LTS-SP1: tomcat, openEuler:20.03-LTS-SP3: tomcat, openEuler:22.03-LTS: tomcat, openEuler:22.03-LTS-SP1: tomcat

The Apache Tomcat software is developed in an open and participatory environment and released under the Apache License version 2. The Apache Tomcat project is intended to be a collaboration of the best-of-breed developers from around the world. We invite you to participate in this open development project Security Fix(es): When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.(CVE-2023-28708)

 https://cve.radiocsirt.org/vuln/opensuse-su-2024:12821-1 openSUSE-SU-2024:12821-1 — tomcat-9.0.43-15.1 on GA media 2026-10-02T17:16:56.220015+00:00

tomcat-9.0.43-15.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2023:4909 RHSA-2023:4909 — Red Hat Security Advisory: Red Hat JBoss Web Server 5.7.4 release and security update 2026-10-02T17:16:56.220032+00:00

apr: integer overflow/wraparound in apr_encode FileUpload: FileUpload DoS with excessive parts tomcat: not including the secure attribute causes information disclosure tomcat: Fix for CVE-2023-24998 was incomplete

 https://cve.radiocsirt.org/vuln/suse-su-2023:1669-1 SUSE-SU-2023:1669-1 — Security update for tomcat 2026-10-02T17:16:56.220055+00:00

Security update for tomcat

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-28708 UBUNTU-CVE-2023-28708 2026-10-02T17:16:56.220070+00:00

Affected: Ubuntu:Pro:14.04:LTS: tomcat7, Ubuntu:Pro:16.04:LTS: tomcat8, Ubuntu:Pro:16.04:LTS: tomcat7, Ubuntu:Pro:18.04:LTS: tomcat8, Ubuntu:Pro:18.04:LTS: tomcat9, Ubuntu:20.04:LTS: tomcat9, Ubuntu:Pro:22.04:LTS: tomcat9, Ubuntu:Pro:24.04:LTS: tomcat9, Ubuntu:25.10: tomcat9

When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel. Older, EOL versions may also be affected.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0717 WID-SEC-W-2023-0717 — Apache Tomcat: Schwachstelle ermöglicht Offenlegung von Informationen 2026-10-02T17:16:56.220104+00:00

Ein entfernter Angreifer kann eine Schwachstelle in Apache Tomcat ausnutzen, um Informationen offenzulegen.