Apache Apache Tomcat

Name: Apache Apache Tomcat
Brand: Apache

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

1critical1high3medium0low

updated 2026-10-27

vulnerabilities (5)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2020-1938US	critical9.8OT critical	99.3% (100th)	KEV	no fix	2020-02-24	3 versions
CVE-2019-0221US	medium6.1	59.2% (99th)	Exploit	no fix	2019-05-28	3 versions
CVE-2020-11996US	high7.5	26.7% (98th)	Exploit	no fix	2020-06-26	3 versions
CVE-2020-1935US	medium4.8	9.39% (95th)	—	no fix	2020-02-24	3 versions
CVE-2019-17569US	medium4.8	8.87% (95th)	—	no fix	2020-02-24	3 versions

The flaw types (CWEs) most of these CVEs share.

CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')2 CVEs
CWE-20Improper Input Validation1 CVEs
CWE-269Improper Privilege Management1 CVEs
CWE-285Improper Authorization1 CVEs
CWE-399CWE-3991 CVEs
CWE-400Uncontrolled Resource Consumption1 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.