pwn.watch: Tomcat incident updates https://pwn.watch/t/tomcat Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Tue, 04 Aug 2026 00:00:00 GMT [high] Apache Tomcat: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability https://pwn.watch/i/apache-tomcat-cve-2026-34486 https://pwn.watch/i/apache-tomcat-cve-2026-34486 Tue, 04 Aug 2026 00:00:00 GMT high <p>Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813. Added to CISA KEV on 2026-08-04.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2026-08-04: CISA added CVE-2026-34486 to the KEV catalog (due 2026-08-07).</li></ul> <p><strong>CVEs:</strong> CVE-2026-34486</p> [critical] Apache Tomcat: Tomcat Path Equivalence Vulnerability https://pwn.watch/i/apache-tomcat-cve-2025-24813 https://pwn.watch/i/apache-tomcat-cve-2025-24813 Tue, 01 Apr 2025 00:00:00 GMT critical <p>Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request. This vulnerability can be chained with CVE‑2026‑34486. Added to CISA KEV on 2025-04-01.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2025-04-01: CISA added CVE-2025-24813 to the KEV catalog (due 2025-04-22).</li></ul> <p><strong>CVEs:</strong> CVE-2025-24813</p>