Apache Software Foundation Tomcat

Name: Apache Software Foundation Tomcat
Brand: Apache Software Foundation

productRU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

8critical34high30medium1low

updated 2026-10-27

vulnerabilities (130)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2023-44487US	high7.5OT critical	100.0% (100th)	KEV	no fix	2023-10-10	4 versions
CVE-2017-12617US	high8.1OT critical	100.0% (100th)	KEV	no fix	2017-10-04	5 versions
CVE-2025-24813US	critical9.8OT critical	99.9% (100th)	KEV	no fix	2025-03-10	3 versions
CVE-2020-1938US	critical9.8OT critical	99.3% (100th)	KEV	no fix	2020-02-24	3 versions
CVE-2026-34486US	—OT critical	98.5% (100th)	KEV	no fix	2026-04-09	3 versions
CVE-2016-8735US	critical9.8OT critical	90.3% (100th)	KEV	no fix	2017-04-06	7 versions
CVE-2019-0232US	high8.1	99.9% (100th)	Exploit	no fix	2019-04-15	3 versions
CVE-2018-11784US	medium4.3	97.7% (100th)	Exploit	no fix	2018-10-04	3 versions
CVE-2020-13935US	high7.5	86.6% (100th)	Exploit	no fix	2020-07-14	3 versions
CVE-2014-0050US	high7.5	83.3% (100th)	Exploit	no fix	2014-04-01	6 versions
CVE-2022-29885US	high7.5	73.5% (99th)	Exploit	no fix	2022-05-12	4 versions
CVE-2025-55752US	—	64.4% (99th)	Exploit	no fix	2025-10-27	3 versions
CVE-2025-31650US	high7.5	61.3% (99th)	Exploit	no fix	2025-04-28	3 versions
CVE-2019-0221US	medium6.1	59.2% (99th)	Exploit	no fix	2019-05-28	3 versions
CVE-2020-9484US	high7.0	55.5% (99th)	Exploit	no fix	2020-05-20	4 versions
CVE-2024-50379US	—	31.8% (98th)	Exploit	no fix	2024-12-17	3 versions
CVE-2025-48988US	—	30.4% (98th)	Exploit	no fix	2025-06-16	3 versions
CVE-2020-11996US	high7.5	26.7% (98th)	Exploit	no fix	2020-06-26	4 versions
CVE-2024-24549US	—	23.1% (98th)	Exploit	no fix	2024-03-13	4 versions
CVE-2014-0075US	medium5.0	17.6% (97th)	Exploit	no fix	2014-05-31	3 versions
CVE-2018-1304US	medium5.9	17.1% (97th)	Exploit	no fix	2018-02-28	4 versions
CVE-2018-1305US	medium6.5	14.5% (97th)	Exploit	no fix	2018-02-23	4 versions
CVE-2024-21733US	medium5.3	14.3% (97th)	Exploit	no fix	2024-01-19	2 versions
CVE-2016-0714US	high8.8	13.1% (96th)	Exploit	no fix	2016-02-25	4 versions
CVE-2023-41080US	medium6.1	6.46% (94th)	Exploit	no fix	2023-08-25	4 versions
CVE-2024-52316US	—	6.25% (94th)	Exploit	no fix	2024-11-18	3 versions
CVE-2025-31651US	critical9.8	4.19% (91st)	Exploit	no fix	2025-04-28	3 versions
CVE-2026-50229US	—	4.09% (91st)	Exploit	no fix	2026-06-29	5 versions
CVE-2025-49125US	—OT elevated	3.44% (89th)	Exploit	no fix	2025-06-16	3 versions
CVE-2025-46701US	—	3.14% (88th)	Exploit	no fix	2025-05-29	3 versions
CVE-2026-55957US	—	2.85% (87th)	Exploit	no fix	2026-06-29	3 versions
CVE-2024-52317US	—	2.10% (82nd)	Exploit	no fix	2024-11-18	3 versions
CVE-2024-52318US	—	1.74% (78th)	Exploit	no fix	2024-11-18	3 versions
CVE-2026-41293US	—	1.70% (77th)	Exploit	no fix	2026-05-12	3 versions
CVE-2026-43512US	—	1.33% (71st)	Exploit	no fix	2026-05-12	3 versions
CVE-2026-43515US	—	1.22% (69th)	Exploit	no fix	2026-05-12	3 versions
CVE-2025-55668US	—	0.86% (58th)	Exploit	no fix	2025-08-13	3 versions
CVE-2026-29145US	—	0.71% (53rd)	Exploit	no fix	2026-04-09	3 versions
CVE-2026-24880US	—	0.70% (53rd)	Exploit	no fix	2026-04-09	5 versions
CVE-2026-24733US	low3.7	0.55% (46th)	Exploit	no fix	2026-02-17	3 versions
CVE-2026-25854US	—	0.53% (44th)	Exploit	no fix	2026-04-09	4 versions
CVE-2022-43980US	medium5.4	0.28% (20th)	Exploit	no fix	2023-01-27	4 versions
CVE-2021-33037US	medium5.3	74.7% (99th)	—	no fix	2021-07-12	3 versions
CVE-2019-10072US	high7.5	73.0% (99th)	—	no fix	2019-06-21	3 versions
CVE-2019-0199US	high7.5	72.9% (99th)	—	no fix	2019-04-10	2 versions
CVE-2020-13934US	high7.5	64.1% (99th)	—	no fix	2020-07-14	3 versions
CVE-2023-28709US	high7.5	48.0% (99th)	—	no fix	2023-05-22	7 versions
CVE-2016-3092US	high7.5	37.2% (99th)	—	no fix	2016-07-04	4 versions
CVE-2018-8034US	high7.5	21.0% (98th)	—	no fix	2018-08-01	41 versions
CVE-2018-8014US	critical9.8OT high	20.9% (98th)	—	no fix	2018-05-16	104 versions

showing 50 of 130

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-20Improper Input Validation20 CVEs
CWE-400Uncontrolled Resource Consumption16 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor7 CVEs
CWE-287Improper Authentication6 CVEs
CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')6 CVEs
CWE-264CWE-2645 CVEs
CWE-284Improper Access Control5 CVEs
CWE-285Improper Authorization5 CVEs

sources (1)

Which sources assert this record, and when.

RUBDU (FSTEC Data Security Threats Database)130 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan