org.apache.tomcat:tomcat vulnerabilities
CVEs whose affected-version data names the org.apache.tomcat:tomcat package (maven). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-55956Medium· 6.5Apache Tomcat has an Improper Authorization vulnerability
Apache Tomcat has an Improper Authorization vulnerability
▾ Sunlitapache · org.apache.tomcat.embed:tomcat-embed-coreEPSS 0.69%via GHSA
CVE-2026-55957High· 7.3PoCApache Tomcat has a Missing Critical Step in Authentication vulnerability
Apache Tomcat has a Missing Critical Step in Authentication vulnerability
▾ Midnightapache · org.apache.tomcat.embed:tomcat-embed-coreEPSS 2.9%via GHSA