ByteOS

Product

Apache Tomcat

Default Status

unaffected

Versions

Affected

From 11.0.0-M1 through 11.0.22 (semver)
From 10.1.0-M7 through 10.1.55 (semver)
From 9.0.83 through 9.0.118 (semver)

Unaffected

From 0 through 9.0.82 (semver)

Problem Types

Type	CWE ID	Description
CWE	CWE-390	CWE-390 Detection of Error Condition Without Action

Type: CWE

CWE ID: CWE-390

Description: CWE-390 Detection of Error Condition Without Action

Metrics Other Info

Textual description of severity

text:

low

References

Hyperlink	Resource
https://lists.apache.org/thread/x510lbq0sfrd1qyo7q3r1mpllgpdcosk	vendor-advisory

Hyperlink: https://lists.apache.org/thread/x510lbq0sfrd1qyo7q3r1mpllgpdcosk

Resource:

vendor-advisory

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
http://www.openwall.com/lists/oss-security/2026/06/29/22	N/A

Hyperlink: http://www.openwall.com/lists/oss-security/2026/06/29/22

Resource: N/A

2. CISA ADP Vulnrichment

Metrics

Version	Base score	Base severity	Vector
3.1	9.1	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Version: 3.1

Base score: 9.1

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:security@apache.org

Published At:29 Jun, 2026 | 21:16

Updated At:02 Jul, 2026 | 19:06

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	9.1	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
			N/A

Type: Secondary

Version: 3.1

Base score: 9.1

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Type: N/A

Version:

Base score:

Base severity: N/A

Vector:

CPE Matches

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

>>tomcat>>Versions from 9.0.83(inclusive) to 9.0.119(exclusive)

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

>>tomcat>>Versions from 10.1.0(inclusive) to 10.1.56(exclusive)

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

>>tomcat>>Versions from 11.0.0(inclusive) to 11.0.23(exclusive)

Weaknesses

CWE ID	Type	Source
CWE-390	Secondary	security@apache.org

CWE ID: CWE-390

Type: Secondary

Source: security@apache.org

References

Hyperlink	Source	Resource
https://lists.apache.org/thread/x510lbq0sfrd1qyo7q3r1mpllgpdcosk	security@apache.org	Vendor Advisory Mailing List
http://www.openwall.com/lists/oss-security/2026/06/29/22	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory

Hyperlink: https://lists.apache.org/thread/x510lbq0sfrd1qyo7q3r1mpllgpdcosk

Source: security@apache.org

Resource:

Vendor Advisory

Mailing List

Hyperlink: http://www.openwall.com/lists/oss-security/2026/06/29/22

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Similar CVEs

63Records found

CVE-2024-32113

Matching Score-8

Matching Score-8

CVSS Score-9.1||CRITICAL

EPSS-99.44% / 99.94%

7 Day CHG~0.00%

Published-08 May, 2024 | 14:50

Updated-23 Oct, 2025 | 14:49

Known KEV||Action Due Date - 2024-08-28||Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Apache OFBiz: Path traversal leading to RCE

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13. Users are recommended to upgrade to version 18.12.13, which fixes the issue.

Product-ofbiz Apache OFBiz ofbiz OFBiz

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2022-25312

Matching Score-8

Matching Score-8

CVSS Score-9.1||CRITICAL

EPSS-2.75% / 84.39%

7 Day CHG~0.00%

Published-04 Mar, 2022 | 23:25

Updated-03 Aug, 2024 | 04:36

An XML external entity (XXE) injection vulnerability exists in the Apache Any23 RDFa XSLTStylesheet extractor

An XML external entity (XXE) injection vulnerability was discovered in the Any23 RDFa XSLTStylesheet extractor and is known to affect Any23 versions < 2.7. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access. This issue is fixed in Apache Any23 2.7.

Product-any23 Apache Any23

CWE ID-CWE-611

Improper Restriction of XML External Entity Reference

CVE-2022-23944

Matching Score-8

Matching Score-8

CVSS Score-9.1||CRITICAL

EPSS-79.01% / 99.55%

7 Day CHG~0.00%

Published-25 Jan, 2022 | 13:00

Updated-03 Aug, 2024 | 03:59

Apache ShenYu 2.4.1 Improper access control

User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1.

Product-shenyu Apache ShenYu (incubating)

CWE ID-CWE-862

Missing Authorization

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2025-57735

Matching Score-8

Matching Score-8

CVSS Score-9.1||CRITICAL

EPSS-0.67% / 47.30%

7 Day CHG~0.00%

Published-09 Apr, 2026 | 11:12

Updated-17 Apr, 2026 | 13:03

Apache Airflow: Airflow Logout Not Invalidating JWT

When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+ Users are recommended to upgrade to version 3.2.0, which fixes this issue.

Product-airflow Apache Airflow

CWE ID-CWE-613

Insufficient Session Expiration

CVE-2025-55017

Matching Score-8

Matching Score-8

CVSS Score-9.1||CRITICAL

EPSS-0.38% / 30.20%

7 Day CHG~0.00%

Published-26 Jun, 2026 | 12:15

Updated-26 Jun, 2026 | 19:16

Apache IoTDB: Path Traversal Vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 2.0.0 before 2.0.6, from 1.0.0 before 1.3.6. Users are recommended to upgrade to version 1.3.6 and 2.0.6, which fixes the issue.

Product-Apache IoTDB

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2024-29868

Matching Score-8

Matching Score-8

CVSS Score-9.1||CRITICAL

EPSS-6.00% / 92.43%

7 Day CHG~0.00%

Published-24 Jun, 2024 | 09:59

Updated-15 Jul, 2025 | 15:39

Apache StreamPipes, Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generation

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerability in Apache StreamPipes user self-registration and password recovery mechanism. This allows an attacker to guess the recovery token in a reasonable time and thereby to take over the attacked user's account. This issue affects Apache StreamPipes: from 0.69.0 through 0.93.0. Users are recommended to upgrade to version 0.95.0, which fixes the issue.

Product-streampipes Apache StreamPipes streampipes

CWE ID-CWE-338

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

CVE-2024-29736

Matching Score-8

Matching Score-8

CVSS Score-7.5||HIGH

EPSS-1.03% / 59.47%

7 Day CHG~0.00%

Published-19 Jul, 2024 | 08:50

Updated-15 Nov, 2024 | 13:08

Apache CXF: SSRF vulnerability via WADL stylesheet parameter

A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices. The attack only applies if a custom stylesheet parameter is configured.

Product-cxf Apache CXF cxf

CWE ID-CWE-918

Server-Side Request Forgery (SSRF)

CVE-2024-27349

Matching Score-8

Matching Score-8

CVSS Score-9.1||CRITICAL

EPSS-1.02% / 59.28%

7 Day CHG~0.00%

Published-22 Apr, 2024 | 14:08

Updated-21 Aug, 2025 | 03:55

Apache HugeGraph-Server: Bypass whitelist in Auth mode

Authentication Bypass by Spoofing vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0. Users are recommended to upgrade to version 1.3.0, which fixes the issue.

Product-hugegraph Apache HugeGraph-Server hugegraph-server

CWE ID-CWE-290

Authentication Bypass by Spoofing

CVE-2024-26580

Matching Score-8

Matching Score-8

CVSS Score-9.1||CRITICAL

EPSS-1.22% / 65.00%

7 Day CHG~0.00%

Published-06 Mar, 2024 | 12:07

Updated-07 May, 2025 | 15:45

Apache InLong: Logged-in user could exploit an arbitrary file read vulnerability

Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.8.0 through 1.10.0, the attackers can use the specific payload to read from an arbitrary file. Users are advised to upgrade to Apache InLong's 1.11.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/9673

Product-inlong Apache InLong inlong

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2024-25065

Matching Score-8

Matching Score-8

CVSS Score-9.1||CRITICAL

EPSS-47.67% / 98.70%

7 Day CHG~0.00%

Published-28 Feb, 2024 | 15:42

Updated-05 May, 2025 | 21:02

Apache OFBiz: Path traversal allowing authentication bypass.

Possible path traversal in Apache OFBiz allowing authentication bypass. Users are recommended to upgrade to version 18.12.12, that fixes the issue.

Product-ofbiz Apache OFBiz ofbiz

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2024-25141

Matching Score-8

Matching Score-8

CVSS Score-9.1||CRITICAL

EPSS-0.62% / 45.29%

7 Day CHG~0.00%

Published-20 Feb, 2024 | 20:30

Updated-28 Apr, 2025 | 18:21

Apache Airflow Mongo Provider: Certificate validation isn't respected even if SSL is enabled for apache-airflow-providers-mongo

When ssl was enabled for Mongo Hook, default settings included "allow_insecure" which caused that certificates were not validated. This was unexpected and undocumented. Users are recommended to upgrade to version 4.0.0, which fixes this issue.

Product-apache-airflow-providers-mongo Apache Airflow Mongo Provider airflow_mongo_provider

CWE ID-CWE-295

Improper Certificate Validation

CVE-2024-23590

Matching Score-8

Matching Score-8

CVSS Score-9.1||CRITICAL

EPSS-0.62% / 45.43%

7 Day CHG~0.00%

Published-04 Nov, 2024 | 09:27

Updated-10 Jul, 2025 | 21:41

Apache Kylin: Session fixation in web interface

Session Fixation vulnerability in Apache Kylin. This issue affects Apache Kylin: from 2.0.0 through 4.x. Users are recommended to upgrade to version 5.0.0 or above, which fixes the issue.

Vendor-apache_software_foundation The Apache Software Foundation

Product-kylin Apache Kylin apache_kylin

CWE ID-CWE-384

Session Fixation

CVE-2023-48396

Matching Score-8

Matching Score-8

CVSS Score-9.1||CRITICAL

EPSS-0.72% / 49.46%

7 Day CHG~0.00%

Published-30 Jul, 2024 | 08:15

Updated-10 Jul, 2025 | 18:49

Apache SeaTunnel Web: Authentication bypass

Web Authentication vulnerability in Apache SeaTunnel. Since the jwt key is hardcoded in the application, an attacker can forge any token to log in any user. Attacker can get secret key in /seatunnel-server/seatunnel-app/src/main/resources/application.yml and then create a token. This issue affects Apache SeaTunnel: 1.0.0. Users are recommended to upgrade to version 1.0.1, which fixes the issue.