https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T15:12:55.054833+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:68651 ALSA-2026:68651 — Moderate: tomcat9 security update 2026-10-02T15:12:55.372486+00:00

Affected: AlmaLinux:10: tomcat9, AlmaLinux:10: tomcat9-admin-webapps, AlmaLinux:10: tomcat9-docs-webapp, AlmaLinux:10: tomcat9-el-3.0-api, AlmaLinux:10: tomcat9-jsp-2.3-api, AlmaLinux:10: tomcat9-lib, AlmaLinux:10: tomcat9-servlet-4.0-api, AlmaLinux:10: tomcat9-webapps

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

* Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990) * tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512) * tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293) * tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498) * tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515) * tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513) * tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083) * tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other relate…

 https://cve.radiocsirt.org/vuln/bdu:2026-14497 bdu:2026-14497 2026-10-02T15:12:55.372577+00:00 bdu:2026-14497 https://cve.radiocsirt.org/vuln/bit-tomcat-2026-59084 BIT-tomcat-2026-59084 — Apache Tomcat: EncryptInterceptor requirements not clearly documented 2026-10-02T15:12:55.372595+00:00

Affected: Bitnami: tomcat

Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented.

This issue affects Apache Tomcat: from 11.0.0 through 11.0.23, from 10.1.0 through 10.1.56, from 9.0.13 through 9.0.119, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120 which fix the issue.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0876 certfr-2026-avi-0876 — De multiples vulnérabilités ont été découvertes dans Apache Tomcat. Elles permettent à un attaquant de provoquer un con… 2026-10-02T15:12:55.372623+00:00 certfr-2026-avi-0876 https://cve.radiocsirt.org/vuln/euvd-2026-336435 EUVD-2026-336435 2026-10-02T15:12:55.372638+00:00 EUVD-2026-336435 https://cve.radiocsirt.org/vuln/fkie_cve-2026-59084 fkie_cve-2026-59084 2026-10-02T15:12:55.372650+00:00

Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.13 through 9.0.119, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120 which fix the issue.

 https://cve.radiocsirt.org/vuln/ghsa-cwxf-7cw2-7r32 GHSA-cwxf-7cw2-7r32 2026-10-02T15:12:55.372675+00:00

Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.13 through 9.0.119, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120 which fix the issue.

 https://cve.radiocsirt.org/vuln/ncsc-2026-0309 NCSC-2026-0309 — Kwetsbaarheden verholpen in Oracle Communications 2026-10-02T15:12:55.372692+00:00 NCSC-2026-0309 https://cve.radiocsirt.org/vuln/oesa-2026-3142 OESA-2026-3142 — tomcat security update 2026-10-02T15:12:55.372724+00:00

Affected: openEuler:22.03-LTS-SP4: tomcat, openEuler:24.03-LTS-SP1: tomcat, openEuler:24.03-LTS-SP3: tomcat, openEuler:24.03-LTS-SP4: tomcat, openEuler:20.03-LTS-SP4: tomcat

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Security Fix(es):

Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.(CVE-2026-59083)

['Severity: low\n\nAffected versions:\n\n- Apache Tomcat 11.0.0-M1 through 11.0.23\n- Apache Tomcat 10.1.0-M1 through 10.1.56\n- Apache Tomcat 9.0.13 through 9.0.119\n- Apache Tomcat 8.5.38 through 8.5.100\n- Apache Tomcat 7.0.100 through 7.0.109\n\nDescription:', 'Credit:\n\nNDIx (reporter)\n\nReferences:'](CVE-2026-59084)

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11399-1 openSUSE-SU-2026:11399-1 — tomcat-9.0.120-1.1 on GA media 2026-10-02T15:12:55.372762+00:00

tomcat-9.0.120-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:36872 RHSA-2026:36872 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update 2026-10-02T15:12:55.372780+00:00

tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations

 https://cve.radiocsirt.org/vuln/rlsa-2026:68651 RLSA-2026:68651 — Moderate: tomcat9 security update 2026-10-02T15:12:55.372798+00:00

Affected: Rocky Linux:10: tomcat9

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

* Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990)

* tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)

* tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)

* tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498)

* tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)

* tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)

* tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)

* tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information…

 https://cve.radiocsirt.org/vuln/suse-su-2026:3440-1 SUSE-SU-2026:3440-1 — Security update for tomcat 2026-10-02T15:12:55.372832+00:00

Security update for tomcat

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-59084 UBUNTU-CVE-2026-59084 2026-10-02T15:12:55.372847+00:00

Affected: Ubuntu:Pro:14.04:LTS: tomcat6, Ubuntu:Pro:14.04:LTS: tomcat7, Ubuntu:Pro:16.04:LTS: tomcat8, Ubuntu:Pro:16.04:LTS: tomcat7, Ubuntu:Pro:18.04:LTS: tomcat8, Ubuntu:Pro:18.04:LTS: tomcat9, Ubuntu:Pro:20.04:LTS: tomcat9, Ubuntu:Pro:22.04:LTS: tomcat9, Ubuntu:24.04:LTS: tomcat10, Ubuntu:24.04:LTS: tomcat9 and 3 more

Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.13 through 9.0.119, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120 which fix the issue.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2310 WID-SEC-W-2026-2310 — Apache Tomcat: Mehrere Schwachstellen 2026-10-02T15:12:55.372883+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache Tomcat ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Informationen offenzulegen.