Org.apache.tomcat.embed:tomcat-embed-core
60 CVEs tracked. 5 of them are in CISA KEV.
This hub aggregates every CVE we track for Org.apache.tomcat.embed:tomcat-embed-core, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Org.apache.tomcat.embed:tomcat-embed-core CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 2 |
| 2024-12 | 2 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 1 |
| 2025-04 | 2 |
| 2025-05 | 1 |
| 2025-06 | 3 |
| 2025-07 | 3 |
| 2025-08 | 2 |
| 2025-09 | 0 |
| 2025-10 | 3 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 1 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 60 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical9
- High34
- Medium17
Latest CVEs
The 15 most recently published vulnerabilities affecting Org.apache.tomcat.embed:tomcat-embed-core.
- CVE-2025-66614Apache Tomcat: Client certificate verification bypass due to virtual host mapping7.6
- CVE-2025-61795Apache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoS5.3
- CVE-2025-55752Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled7.5
- CVE-2025-55754Apache Tomcat: console manipulation via escape sequences in log messages9.6
- CVE-2025-55668Apache Tomcat: session fixation via rewrite valve6.5
- CVE-2025-48989Apache Tomcat: h2 DoS - Made You Reset7.5
- CVE-2025-53506Apache Tomcat: DoS via excessive h2 streams at connection start7.5
- CVE-2025-52520Apache Tomcat: DoS via integer overflow in multipart file upload7.5
- CVE-2025-52434Apache Tomcat: APR/Native Connector crash leading to DoS7.5
- CVE-2025-49124Apache Tomcat: exe side-loading via icalcs.exe in Tomcat installer for Windows8.4
- CVE-2025-49125Apache Tomcat: Security constraint bypass for pre/post-resources7.5
- CVE-2025-48988Apache Tomcat: FileUpload large number of parts with headers DoS7.5
- CVE-2025-46701Apache Tomcat: Security constraint bypass for CGI scripts7.3
- CVE-2025-31651Apache Tomcat: Bypass of rules in Rewrite Valve9.8
- CVE-2025-31650Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame7.5
Product grouping is registry-driven, with AI assist and human review. How it works