Product by Apache Software Foundation
Apache Tomee
39 known vulnerabilities in Apache Tomee (Apache Software Foundation), 0 of them actively exploited (CISA KEV).
Key figures
39
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Medium | CVE-2018-8031 | Apache TomEE: Cross-Site Scripting (XSS) | 6.1 | |
| Not rated | CVE-2026-111264 | Apache TomEE: Authentication bypass on EJB web service endpoints via HTTP method | — | |
| Not rated | CVE-2026-111263 | Apache TomEE: Missing authentication on EJB web service endpoints deployed in a web application | — | |
| Not rated | CVE-2026-111242 | Apache TomEE: Privilege escalation via leaked MicroProfile JWT run-as identity | — | |
| Not rated | CVE-2026-111250 | Apache TomEE: Authentication bypass via programmatic authentication in embedded HTTP server | — | |
| Not rated | CVE-2026-97880 | Apache TomEE: Improper Authentication | — | |
| Not rated | CVE-2026-111245 | Apache TomEE: Privilege escalation via WS-Security caller identity leaking between requests | — | |
| Not rated | CVE-2026-111262 | Apache TomEE: LDAP injection in LDAP identity store | — | |
| Not rated | CVE-2026-111244 | Apache TomEE: Authorization bypass in MicroProfile JWT role checks for JAX-RS resources | — | |
| Not rated | CVE-2026-87756 | Apache TomEE: Missing authorization on internal deployer EJBs in default profile | — | |
| Not rated | CVE-2026-111260 | Apache TomEE: Predictable OpenID Connect state and nonce values | — | |
| Not rated | CVE-2026-97872 | Apache TomEE: Authentication bypass of Hessian EJB endpoints due to ignored security settings | — | |
| Not rated | CVE-2026-111258 | Apache TomEE: Security constraint bypass via request routing | — | |
| Not rated | CVE-2026-111257 | Apache TomEE: Well-known administrative credentials created at startup | — | |
| Not rated | CVE-2026-97874 | Apache TomEE: Authentication bypass for Hessian endpoints in non-root web applications | — | |
| Not rated | CVE-2026-97870 | Apache TomEE: Missing authentication for Hessian endpoints in embedded HTTP server | — | |
| Not rated | CVE-2026-111256 | Apache TomEE: Missing authentication for web service endpoints in embedded HTTP server | — | |
| Not rated | CVE-2026-97888 | Apache TomEE: Caller identity leaks across requests in embedded HTTP server | — | |
| Not rated | CVE-2026-86811 | Apache TomEE: Path traversal via stateful EJB passivation | — | |
| Not rated | CVE-2026-111259 | Apache TomEE: Predictable HTTP session identifiers in embedded server | — | |
| Not rated | CVE-2026-97881 | Apache TomEE: Path traversal in embedded HTTP server static resource handling | — | |
| Not rated | CVE-2026-86532 | Apache TomEE: Username enumeration and timing side channel in JAAS login modules | — | |
| Not rated | CVE-2026-111239 | Apache TomEE: Code execution by any authenticated user via the SSH administration shell | — | |
| Not rated | CVE-2026-87755 | Apache TomEE: Stateful session bean hijacking via predictable session identifiers | — | |
| Not rated | CVE-2026-86531 | Apache TomEE: DoS via unbounded request body and multipart handling in embedded HTTP server | — |