Exposure of Apache Tomcat

Web servers
501
exposure score
13,840
sites use
6
exploited
34
critical

CVEs

174 results
CVE-2026-80353HIGHApache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connectorEPSS 0.4%CVE-2026-74049MEDIUMApache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)EPSS 0.4%CVE-2025-49124HIGHApache Tomcat: exe side-loading via icalcs.exe in Tomcat installer for WindowsEPSS 0.4%CVE-2026-43514LOWApache Tomcat: AJP secret compared in non-constant timeEPSS 0.4%CVE-2026-86246CRITICALApache Tomcat Native: Insecure OpenSSL options enabledEPSS 0.3%CVE-2024-46544MEDIUMApache Tomcat Connectors: mod_jk: local users can view and modify configurationEPSS 0.3%CVE-2026-32990MEDIUMApache Tomcat: Fix for CVE-2025-66614 is incompleteEPSS 0.3%CVE-2025-66614HIGHApache Tomcat: Client certificate verification bypass due to virtual host mappingEPSS 0.3%CVE-2026-29129HIGHApache Tomcat: TLS cipher order is not preservedEPSS 0.3%CVE-2025-40720MEDIUMReflected Cross-site Scripting (XSS) vulnerability in Quiter GatewayEPSS 0.3%CVE-2025-40719MEDIUMReflected Cross-site Scripting (XSS) vulnerability in Quiter GatewayEPSS 0.3%CVE-2025-40721MEDIUMReflected Cross-site Scripting (XSS) vulnerability in Quiter GatewayEPSS 0.2%CVE-2026-86247HIGHApache Tomcat Native: Client certificate requirements can be down-gradedEPSS 0.2%CVE-2026-73581MEDIUMApache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystoreEPSS 0.2%