# Apache Tomcat


- [CVE-2025-24813](https://insights.sbomify.com/CVE-2025-24813/): Apache Tomcat Path Equivalence (critical 10.0, exploited in the wild)
- [CVE-2020-1938](https://insights.sbomify.com/CVE-2020-1938/): Apache Tomcat Improper Privilege Management (critical 9.8, exploited in the wild)
- [CVE-2016-8735](https://insights.sbomify.com/CVE-2016-8735/): Apache Tomcat Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2017-12617](https://insights.sbomify.com/CVE-2017-12617/): Apache Tomcat Remote Code Execution (high 8.1, exploited in the wild)
- [CVE-2017-12615](https://insights.sbomify.com/CVE-2017-12615/): Apache Tomcat on Windows Remote Code Execution (high 8.1, exploited in the wild)
- [CVE-2026-34486](https://insights.sbomify.com/CVE-2026-34486/): Apache Tomcat Missing Encryption of Sensitive Data (high 7.5, exploited in the wild)
- [CVE-2023-44487](https://insights.sbomify.com/CVE-2023-44487/): HTTP/2 Rapid Reset Attack (high 7.5, exploited in the wild)
- [CVE-2026-65637](https://insights.sbomify.com/CVE-2026-65637/): Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete (critical 9.8)
- [CVE-2026-65905](https://insights.sbomify.com/CVE-2026-65905/): Apache Tomcat: Limited replay attack possible with DIGEST authentication (critical 9.8)
- [CVE-2026-41293](https://insights.sbomify.com/CVE-2026-41293/): Apache Tomcat: HTTP/2 request headers not validated (critical 9.8)
- [CVE-2026-43512](https://insights.sbomify.com/CVE-2026-43512/): Apache Tomcat: Digest authenticator will authenticate any unknown user (critical 9.8)
- [CVE-2025-31651](https://insights.sbomify.com/CVE-2025-31651/): Apache Tomcat: Bypass of rules in Rewrite Valve (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/products/apache/tomcat/