Apache TomEE
- Software type
- Other
- Total vulnerabilities (90 days)
- 38
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/13/2026, Apache TomEE recorded 38 security vulnerabilities in the last 90 days, of which 0 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of Apache TomEE and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-97890Apache TomEE: Session fixation in embedded HTTP serverCVE-2026-97888Apache TomEE: Caller identity leaks across requests in embedded HTTP serverCVE-2026-97881Apache TomEE: Path traversal in embedded HTTP server static resource handlingCVE-2026-97880Apache TomEE: Authentication bypass in the embedded HTTP server for endpoints protected by HTTP Basic authenticationCVE-2026-97874Apache TomEE: Authentication bypass for Hessian endpoints in non-root web applications| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-97890Apache TomEE: Session fixation in embedded HTTP server | Exploitation statusNot confirmed | FixYes |
| SeverityUnknown |
CVE-2026-97888Apache TomEE: Caller identity leaks across requests in embedded HTTP server | Exploitation statusNot confirmed | FixYes | Published11/10/2026 | SeverityUnknown |
|---|
CVE-2026-97881Apache TomEE: Path traversal in embedded HTTP server static resource handling | Exploitation statusNot confirmed | FixYes | Published11/10/2026 | SeverityUnknown |
|---|
CVE-2026-97880Apache TomEE: Authentication bypass in the embedded HTTP server for endpoints protected by HTTP Basic authentication | Exploitation statusNot confirmed | FixYes | Published11/10/2026 | SeverityUnknown |
|---|
CVE-2026-97874Apache TomEE: Authentication bypass for Hessian endpoints in non-root web applications | Exploitation statusNot confirmed | FixYes | Published11/10/2026 | SeverityUnknown |
|---|
CVE-2026-97872Apache TomEE: Authentication bypass of Hessian EJB endpoints due to ignored security settings | Exploitation statusNot confirmed | FixYes | Published11/10/2026 | SeverityUnknown |
|---|
CVE-2026-97870Apache TomEE: Missing authentication for Hessian endpoints in embedded HTTP server | Exploitation statusNot confirmed | FixYes | Published11/10/2026 | SeverityUnknown |
|---|
CVE-2026-97867Apache TomEE: Database credential disclosure via remote JNDI lookup | Exploitation statusNot confirmed | FixYes | Published11/10/2026 | SeverityUnknown |
|---|
CVE-2026-97849Apache TomEE: Derby network service listens on all interfaces | Exploitation statusNot confirmed | FixYes | Published11/10/2026 | SeverityUnknown |
|---|
CVE-2026-87758Apache TomEE: Missing TLS hostname verification in ejbds client connections | Exploitation statusNot confirmed | FixYes | Published11/10/2026 | SeverityUnknown |
|---|
CVE-2026-87756Apache TomEE: Missing authorization on internal deployer EJBs in default profile | Exploitation statusNot confirmed | FixYes | Published11/10/2026 | SeverityUnknown |
|---|
CVE-2026-87755Apache TomEE: Stateful session bean hijacking via predictable session identifiers | Exploitation statusNot confirmed | FixYes | Published11/10/2026 | SeverityUnknown |
|---|
CVE-2026-86811Apache TomEE: Path traversal via stateful EJB passivation | Exploitation statusNot confirmed | FixYes | Published11/10/2026 | SeverityUnknown |
|---|
CVE-2026-86532Apache TomEE: Username enumeration and timing side channel in JAAS login modules | Exploitation statusNot confirmed | FixYes | Published11/10/2026 | SeverityUnknown |
|---|
CVE-2026-86531Apache TomEE: DoS via unbounded request body and multipart handling in embedded HTTP server | Exploitation statusNot confirmed | FixYes | Published11/10/2026 | SeverityUnknown |
|---|
CVE-2026-86336Apache TomEE: EJB method authorization is silently skipped on JDK 21+ | Exploitation statusNot confirmed | FixYes | Published11/10/2026 | SeverityUnknown |
|---|
CVE-2026-111264Apache TomEE: Authentication bypass on EJB web service endpoints via HTTP method | Exploitation statusNot confirmed | FixYes | Published11/10/2026 | SeverityUnknown |
|---|
CVE-2026-111263Apache TomEE: Missing authentication on EJB web service endpoints deployed in a web application | Exploitation statusNot confirmed | FixYes | Published11/10/2026 | SeverityUnknown |
|---|
CVE-2026-111262Apache TomEE: LDAP injection in LDAP identity store | Exploitation statusNot confirmed | FixYes | Published11/10/2026 | SeverityUnknown |
|---|
CVE-2026-111261Apache TomEE: Authentication bypass with empty password in LDAP identity store | Exploitation statusNot confirmed | FixYes | Published11/10/2026 | SeverityUnknown |
|---|
CVE-2026-111260Apache TomEE: Predictable OpenID Connect state and nonce values | Exploitation statusNot confirmed | FixYes | Published11/10/2026 | SeverityUnknown |
|---|
CVE-2026-111259Apache TomEE: Predictable HTTP session identifiers in embedded server | Exploitation statusNot confirmed | FixYes | Published11/10/2026 | SeverityUnknown |
|---|
CVE-2026-111258Apache TomEE: Security constraint bypass via request routing | Exploitation statusNot confirmed | FixYes | Published11/10/2026 | SeverityUnknown |
|---|
CVE-2026-111257Apache TomEE: Well-known administrative credentials created at startup | Exploitation statusNot confirmed | FixYes | Published11/10/2026 | SeverityUnknown |
|---|
CVE-2026-111256Apache TomEE: Missing authentication for web service endpoints in embedded HTTP server | Exploitation statusNot confirmed | FixYes | Published11/10/2026 | SeverityUnknown |
|---|
CVE-2026-111251Apache TomEE: Unauthenticated server shutdown via the admin port | Exploitation statusNot confirmed | FixYes | Published11/10/2026 | SeverityUnknown |
|---|
CVE-2026-111250Apache TomEE: Authentication bypass via programmatic authentication in embedded HTTP server | Exploitation statusNot confirmed | FixYes | Published11/10/2026 | SeverityUnknown |
|---|
CVE-2026-111249Apache TomEE: Unauthenticated LiveReload endpoint reachable from the network | Exploitation statusNot confirmed | FixYes | Published11/10/2026 | SeverityUnknown |
|---|
CVE-2026-111248Apache TomEE: Authentication with the stored password digest in Tomcat user identity store | Exploitation statusNot confirmed | FixYes | Published11/10/2026 | SeverityUnknown |
|---|
CVE-2026-111247Apache TomEE: Privilege escalation via user name matching a role name | Exploitation statusNot confirmed | FixYes | Published11/10/2026 | SeverityUnknown |
|---|
CVE-2026-111246Apache TomEE: HTTP sessions shared across web applications in embedded HTTP server | Exploitation statusNot confirmed | FixYes | Published11/10/2026 | SeverityUnknown |
|---|
CVE-2026-111245Apache TomEE: Privilege escalation via WS-Security caller identity leaking between requests | Exploitation statusNot confirmed | FixYes | Published11/10/2026 | SeverityUnknown |
|---|
CVE-2026-111244Apache TomEE: Authorization bypass in MicroProfile JWT role checks for JAX-RS resources | Exploitation statusNot confirmed | FixYes | Published11/10/2026 | SeverityUnknown |
|---|
CVE-2026-111243Apache TomEE: Expired MicroProfile JWT tokens accepted with negative clock skew | Exploitation statusNot confirmed | FixYes | Published11/10/2026 | SeverityUnknown |
|---|
CVE-2026-111242Apache TomEE: Privilege escalation via leaked MicroProfile JWT run-as identity | Exploitation statusNot confirmed | FixYes | Published11/10/2026 | SeverityUnknown |
|---|
CVE-2026-111241Apache TomEE: Local code execution via predictable passivation files in the shared temporary directory | Exploitation statusNot confirmed | FixYes | Published11/10/2026 | SeverityUnknown |
|---|
CVE-2026-111240Apache TomEE: Authentication bypass for accounts without a stored password in SQL login module | Exploitation statusNot confirmed | FixYes | Published11/10/2026 | SeverityUnknown |
|---|
CVE-2026-111239Apache TomEE: Code execution by any authenticated user via the SSH administration shell | Exploitation statusNot confirmed | FixYes | Published11/10/2026 | SeverityUnknown |
|---|
38 Results | Page 1 of 1