// stack

Java

Security incidents affecting java runtimes and app servers (Tomcat, WebLogic, ActiveMQ). Newest first.

## 3 Java incidents in the last year

through Oct 22, 2026

crit 4 · high 3 · med 2 · low 1 · upd ½severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½lessmore

show 3 older incidents

Aug 24highOracle HTTP Server and Oracle Weblogic Server Proxy Plug-in: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerabilitypatched
› Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in patched
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data. Added to CISA KEV on 2026-08-24.
open incident →CVE-2026-21962
Aug 4highApache Tomcat: Apache Tomcat Missing Encryption of Sensitive Data Vulnerabilitypatched
› Apache Tomcat patched
Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813. Added to CISA KEV on 2026-08-04.
open incident →CVE-2026-34486

Apr 16highApache ActiveMQ: Apache ActiveMQ Improper Input Validation Vulnerabilitypatched
› Apache ActiveMQ patched
Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection. Added to CISA KEV on 2026-04-16.
open incident →CVE-2026-34197