tag
Apache-Tomcat
High
Apache Tomcat Split-Collection Security Constraint Bypass (CVE-2026-43515)
CVE-2026-43515·
Apache Tomcat — org.apache.catalina.realm.RealmBase.findSecurityConstraints()
patched
Medium
Apache Tomcat LoadBalancerDrainingValve — Cross-System Open Redirect / Session Fixation (CVE-2026-25854)
CVE-2026-25854·
Apache Tomcat (clustered, using LoadBalancerDrainingValve)
patched