apache tomcat

Name: apache tomcat
Brand: apache

productUS

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

9critical65high128medium15low

updated 2026-10-27

vulnerabilities (274)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2023-44487US	high7.5OT critical	100.0% (100th)	KEV	no fix	2023-10-10	4 versions
CVE-2017-12617US	high8.1OT critical	100.0% (100th)	KEV	9.0.1	2017-10-04	4 versions
CVE-2025-24813US	critical9.8OT critical	99.9% (100th)	KEV	11.0.3	2025-03-10	5 versions
CVE-2017-12615US	high8.1OT critical	99.7% (100th)	KEV	no fix	2017-09-19	7.0.0 → 7.0.79
CVE-2020-1938US	critical9.8OT critical	99.3% (100th)	KEV	9.0.31	2020-02-24	3 versions
CVE-2026-34486US	—OT critical	98.5% (100th)	KEV	no fix	2026-04-09	3 versions
CVE-2016-8735US	critical9.8OT critical	90.3% (100th)	KEV	8.5.7	2017-04-06	5 versions
CVE-2019-0232US	high8.1	99.9% (100th)	Exploit	no fix	2019-04-15	4 versions
CVE-2008-2938US	medium4.3	99.7% (100th)	Exploit	no fix	2008-08-13	3 versions
CVE-2018-11784US	medium4.3	97.7% (100th)	Exploit	no fix	2018-10-04	4 versions
CVE-2009-0580US	medium4.3	94.4% (100th)	Exploit	no fix	2009-06-05	85 versions
CVE-2007-0450US	medium5.0	91.2% (100th)	Exploit	5.5.22	2007-03-16	2 versions
CVE-2020-13935US	high7.5	86.6% (100th)	Exploit	no fix	2020-07-14	5 versions
CVE-2014-0050US	high7.5	83.3% (100th)	Exploit	no fix	2014-04-01	53 versions
CVE-2011-4858US	medium5.0	79.7% (100th)	Exploit	no fix	2012-01-05	59 versions
CVE-2009-3548US	high7.5	79.0% (100th)	Exploit	no fix	2009-11-12	139 versions
CVE-2007-2449US	medium4.3	77.4% (100th)	Exploit	no fix	2007-06-14	73 versions
CVE-2008-1232US	medium4.3	75.9% (100th)	Exploit	no fix	2008-08-04	3 versions
CVE-2022-29885US	high7.5	73.5% (99th)	Exploit	no fix	2022-05-12	4 versions
CVE-2006-7196US	medium4.3	72.2% (99th)	Exploit	no fix	2007-05-10	54 versions
CVE-2025-55752US	—	64.4% (99th)	Exploit	11.0.11	2025-10-27	6 versions
CVE-2007-5333US	medium5.0	62.6% (99th)	Exploit	no fix	2008-02-12	3 versions
CVE-2000-0760US	medium6.4	62.5% (99th)	Exploit	no fix	2000-10-20	2 versions
CVE-2025-31650US	high7.5	61.3% (99th)	Exploit	9.0.104	2025-04-28	4 versions
CVE-2019-0221US	medium6.1	59.2% (99th)	Exploit	no fix	2019-05-28	4 versions
CVE-2007-3386US	medium4.3	59.0% (99th)	Exploit	no fix	2007-08-14	39 versions
CVE-2007-1355US	medium4.3	58.2% (99th)	Exploit	no fix	2007-05-21	52 versions
CVE-2020-9484US	high7.0	55.5% (99th)	Exploit	7.0.108	2020-05-20	5 versions
CVE-2010-2227US	medium6.4	54.8% (99th)	Exploit	no fix	2010-07-13	55 versions
CVE-2008-2370US	medium5.0	52.7% (99th)	Exploit	no fix	2008-08-04	82 versions
CVE-2010-1157US	low2.6	52.5% (99th)	Exploit	no fix	2010-04-23	53 versions
CVE-2006-3835US	medium5.0	48.1% (99th)	Exploit	no fix	2006-07-25	5 versions
CVE-2003-0042US	medium5.0	46.0% (99th)	Exploit	no fix	2003-02-07	9 versions
CVE-2010-4172US	medium4.3	42.0% (99th)	Exploit	no fix	2010-11-26	19 versions
CVE-2002-2007US	medium5.0	41.4% (99th)	Exploit	no fix	2002-12-31	2 versions
CVE-2007-5461US	low3.5	39.7% (99th)	Exploit	no fix	2007-10-15	44 versions
CVE-2016-6816US	high7.1	39.6% (99th)	Exploit	no fix	2017-03-20	168 versions
CVE-2007-3382US	medium4.3	37.5% (99th)	Exploit	no fix	2007-08-14	84 versions
CVE-2003-0866US	medium5.0	34.8% (98th)	Exploit	no fix	2003-11-17	7 versions
CVE-2024-50379US	—	31.8% (98th)	Exploit	11.0.2	2024-12-17	3 versions
CVE-2002-2006US	medium5.0	30.7% (98th)	Exploit	no fix	2002-12-31	14 versions
CVE-2025-48988US	—	30.4% (98th)	Exploit	10.1.42	2025-06-16	3 versions
CVE-2002-0936US	medium5.0	27.3% (98th)	Exploit	no fix	2002-10-04	= 4.0.3
CVE-2002-1567US	medium6.8	27.1% (98th)	Exploit	no fix	2003-10-06	= 4.1.0
CVE-2020-11996US	high7.5	26.7% (98th)	Exploit	no fix	2020-06-26	4 versions
CVE-2005-4703US	medium5.0	25.7% (98th)	Exploit	no fix	2005-12-31	= 4.0.3
CVE-2000-0759US	medium6.4	25.7% (98th)	Exploit	no fix	2000-10-20	= 3.1
CVE-2020-17527US	high7.5	24.6% (98th)	Exploit	no fix	2020-12-03	10 versions
CVE-2024-24549US	—	23.1% (98th)	Exploit	10.1.19	2024-03-13	4 versions
CVE-2008-0128US	medium5.0	19.6% (97th)	Exploit	no fix	2008-01-23	≤ 5.5.20

showing 50 of 274

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-200Exposure of Sensitive Information to an Unauthorized Actor38 CVEs
CWE-20Improper Input Validation37 CVEs
CWE-400Uncontrolled Resource Consumption26 CVEs
CWE-264CWE-26421 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')20 CVEs
CWE-287Improper Authentication15 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')13 CVEs
CWE-284Improper Access Control13 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE274 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan