Apache Software Foundation Tomee vulnerabilities

• apache software foundation tomee Apache TomEE: EJB method authorization is silently skipped on JDK 21+ CVE-2026-86336 No scoreNovember 10, 2026
• apache software foundation tomee Apache TomEE: DoS via unbounded request body and multipart handling in embedded HTTP server CVE-2026-86531 No scoreNovember 10, 2026
• apache software foundation tomee Apache TomEE: Missing TLS hostname verification in ejbds client connections CVE-2026-87758 No scoreNovember 10, 2026
• apache software foundation tomee Apache TomEE: Derby network service listens on all interfaces CVE-2026-97849 No scoreNovember 10, 2026
• apache software foundation tomee Apache TomEE: Database credential disclosure via remote JNDI lookup CVE-2026-97867 No scoreNovember 10, 2026
• apache software foundation tomee Apache TomEE: Missing authentication for Hessian endpoints in embedded HTTP server CVE-2026-97870 No scoreNovember 10, 2026
• apache software foundation tomee Apache TomEE: Authentication bypass of Hessian EJB endpoints due to ignored security settings CVE-2026-97872 No scoreNovember 10, 2026
• apache software foundation tomee Apache TomEE: Authentication bypass for Hessian endpoints in non-root web applications CVE-2026-97874 No scoreNovember 10, 2026
• apache software foundation tomee Apache TomEE: Authentication bypass in the embedded HTTP server for endpoints protected by HTTP Basic authentication CVE-2026-97880 No scoreNovember 10, 2026
• apache software foundation tomee Apache TomEE: Path traversal in embedded HTTP server static resource handling CVE-2026-97881 No scoreNovember 10, 2026
• apache software foundation tomee Apache TomEE: Caller identity leaks across requests in embedded HTTP server CVE-2026-97888 No scoreNovember 10, 2026
• apache software foundation tomee Apache TomEE: Session fixation in embedded HTTP server CVE-2026-97890 No scoreNovember 10, 2026
• apache software foundation tomee Apache TomEE: Code execution by any authenticated user via the SSH administration shell CVE-2026-111239 No scoreNovember 10, 2026
• apache software foundation tomee Apache TomEE: Authentication bypass for accounts without a stored password in SQL login module CVE-2026-111240 No scoreNovember 10, 2026
• apache software foundation tomee Apache TomEE: Local code execution via predictable passivation files in the shared temporary directory CVE-2026-111241 No scoreNovember 10, 2026
• apache software foundation tomee Apache TomEE: Privilege escalation via leaked MicroProfile JWT run-as identity CVE-2026-111242 No scoreNovember 10, 2026
• apache software foundation tomee Apache TomEE: Expired MicroProfile JWT tokens accepted with negative clock skew CVE-2026-111243 No scoreNovember 10, 2026
• apache software foundation tomee Apache TomEE: Authorization bypass in MicroProfile JWT role checks for JAX-RS resources CVE-2026-111244 No scoreNovember 10, 2026
• apache software foundation tomee Apache TomEE: Privilege escalation via WS-Security caller identity leaking between requests CVE-2026-111245 No scoreNovember 10, 2026
• apache software foundation tomee Apache TomEE: HTTP sessions shared across web applications in embedded HTTP server CVE-2026-111246 No scoreNovember 10, 2026
• apache software foundation tomee Apache TomEE: Privilege escalation via user name matching a role name CVE-2026-111247 No scoreNovember 10, 2026
• apache software foundation tomee Apache TomEE: Authentication with the stored password digest in Tomcat user identity store CVE-2026-111248 No scoreNovember 10, 2026
• apache software foundation tomee Apache TomEE: Unauthenticated LiveReload endpoint reachable from the network CVE-2026-111249 No scoreNovember 10, 2026
• apache software foundation tomee Apache TomEE: Authentication bypass via programmatic authentication in embedded HTTP server CVE-2026-111250 No scoreNovember 10, 2026
• apache software foundation tomee Apache TomEE: Unauthenticated server shutdown via the admin port CVE-2026-111251 No scoreNovember 10, 2026
• apache software foundation tomee Apache TomEE: Missing authentication for web service endpoints in embedded HTTP server CVE-2026-111256 No scoreNovember 10, 2026
• apache software foundation tomee Apache TomEE: Well-known administrative credentials created at startup CVE-2026-111257 No scoreNovember 10, 2026
• apache software foundation tomee Apache TomEE: Security constraint bypass via request routing CVE-2026-111258 No scoreNovember 10, 2026
• apache software foundation tomee Apache TomEE: Predictable HTTP session identifiers in embedded server CVE-2026-111259 No scoreNovember 10, 2026
• apache software foundation tomee Apache TomEE: Predictable OpenID Connect state and nonce values CVE-2026-111260 No scoreNovember 10, 2026
• apache software foundation tomee Apache TomEE: Authentication bypass with empty password in LDAP identity store CVE-2026-111261 No scoreNovember 10, 2026
• apache software foundation tomee Apache TomEE: LDAP injection in LDAP identity store CVE-2026-111262 No scoreNovember 10, 2026
• apache software foundation tomee Apache TomEE: Missing authentication on EJB web service endpoints deployed in a web application CVE-2026-111263 No scoreNovember 10, 2026
• apache software foundation tomee Apache TomEE: Authentication bypass on EJB web service endpoints via HTTP method CVE-2026-111264 No scoreNovember 10, 2026
• apache software foundation tomee Apache TomEE: Missing authorization on internal deployer EJBs in default profile CVE-2026-87756 No scoreNovember 10, 2026
• apache software foundation tomee Apache TomEE: Stateful session bean hijacking via predictable session identifiers CVE-2026-87755 No scoreNovember 10, 2026
• apache software foundation tomee Apache TomEE: Path traversal via stateful EJB passivation CVE-2026-86811 No scoreNovember 10, 2026
• apache software foundation tomee Apache TomEE: Username enumeration and timing side channel in JAAS login modules CVE-2026-86532 No scoreNovember 10, 2026
• apache tomee Remote code execution in Apache TomEE CVE-2020-13931 Fix available 9.8 CriticalDecember 17, 2020
• apache tomee Missing Authentication for Critical Function in Apache TomEE CVE-2020-11969 Fix available 9.8 CriticalJune 15, 2020
• apache tomee Apache TomEE console vulnerable to Cross-site Scripting CVE-2018-8031 Fix available 6.1 MediumJuly 23, 2018