{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c41f333a-e6f3-5547-8b86-699449007866", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat", "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2", "version": "10.1.50-tuxcare.2", "pedigree": { "ancestors": [ { "name": "tomcat", "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.50", "type": "library", "group": "org.apache.tomcat", "version": "10.1.50" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2008-1947", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:d1c90b1d-eef0-5227-936f-4a0240b362d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2008-1947 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2013-4590", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:ffa70417-ccde-5969-b99e-9bb68da71641", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-4590 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2015-5174", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:49498625-ec6f-512d-8c06-5b4c313c39ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5174 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2015-5346", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:5a9a22f0-f419-5376-838b-b803e69fb392", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5346 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2016-0706", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:5c85bbab-4af0-5743-bf22-2cc2691eca6e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-0706 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2016-0762", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:f6d2c412-3c56-5fdb-b207-cf15cb889c35", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-0762 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2016-0763", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:1f714f8f-e715-5113-82f2-46dc40996770", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-0763 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2016-6794", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:4abb12e2-4ed3-5280-bbb2-84105cac10b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-6794 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2016-6796", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:b2472ffd-4f3b-517b-8e35-21e10891bd6e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-6796 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2016-6797", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:0e2ff5d0-e780-52d6-903b-49f29907f745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-6797 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2016-6817", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:aee1b52a-a4c3-58c4-9be9-a2aed8412aa1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-6817 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2016-8747", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:8147aca3-4720-59fb-bc32-6359706e6472", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-8747 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2017-5647", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:f3f7e56b-c3ee-57f4-bac5-16c5f8e7df10", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-5647 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2017-5650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:a88d8ec7-517b-5437-b796-5314a9cf9298", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-5650 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2017-5664", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:3f578069-6fca-51cd-b2f3-267fb9a9672b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-5664 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2017-7674", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:b852168d-36e3-50fe-89e6-e37cec0173b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7674 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2017-7675", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:8361c648-6d77-5247-9234-578e780cacf7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7675 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2019-0221", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:329d6775-8346-5dc1-bab2-cb6d38428936", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-0221 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2019-17569", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:b5d3dd02-54c6-54b8-ba51-aa4c702f02e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17569 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2020-11996", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:3d8b6a3b-a8d2-550d-aefb-9721a25e55b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-11996 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2020-13934", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:33ebe180-34ad-5306-8877-17626e39923d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-13934 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2020-13935", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:435a7658-3bcb-5fae-b2cc-926627f0adb1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-13935 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2020-1935", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:687d6761-91e4-55a6-a19f-6e1c9b7118f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1935 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2020-8022", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:a4896a16-e16d-5c64-8b6d-cf3676c563c1", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat 10.1.50-tuxcare.2." } }, { "id": "CVE-2021-30639", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:600e8bc6-9792-590d-bb16-a91abeccc4f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-30639 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2021-30640", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:4a11416f-d09d-5d38-9f70-bd54ba562cac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-30640 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2021-33037", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:8df57def-62cc-522b-8fa3-78fd7ab8dfcc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-33037 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 Target version 10.1.50 is not affected by CVE-2021-33037. All three fixes from the upstream Apache Tomcat project were already present in the upstream 10.1.50 release when TuxCare onboarded it in October 2026. The CVE affected Tomcat 10.0.0-M1 to 10.0.6, and version 10.1.50 was released after the vulnerability was fixed upstream in May-June 2021. No TuxCare backport was needed for this version.", "justification": "code_not_present" } }, { "id": "CVE-2021-41079", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:11339f7c-e155-51a6-91b5-75dab45ce9f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-41079 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2021-42340", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:3b193f81-f4cb-5c78-a82b-41c11086d4ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-42340 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2021-43980", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:c8b27bbd-471d-54b7-bef1-0adc8bd2576b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-43980 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 Target version 10.1.50 already contains the upstream fix for CVE-2021-43980. The vulnerability affected versions 10.1.0 to 10.1.0-M12, and the fix (commit 17f177eeb7df5938f67ef9ea580411b120195f13 by Mark Thomas) was applied starting from 10.1.0-M13. Version 10.1.50 is well beyond the affected range and the fix was already present in the upstream release when TuxCare onboarded it. The code uses ...", "justification": "code_not_present" } }, { "id": "CVE-2022-23181", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:2d3e0ab9-27f1-50fb-b3c2-a4e7824398ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-23181 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2022-25762", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:26ec0a2b-b145-5532-85de-ff71a51ca5a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25762 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2022-29885", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:0cfc2834-d6d9-5096-ae36-929cc020e45b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-29885 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2022-34305", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:c50ab246-1ce1-567c-91b2-5490fe9043dd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-34305 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 Target Apache Tomcat 10.1.50 is NOT AFFECTED by CVE-2022-34305. The XSS vulnerability in the Form authentication example (webapps/examples/jsp/security/protected/index.jsp) has been fixed with HTML entity encoding via util.HTMLFilter.filter(). The fix commit d6251d1cfb was authored by upstream Apache developer Mark Thomas (markt@apache.org) and was already present in the upstream release 10.1.5...", "justification": "code_not_present" } }, { "id": "CVE-2023-41080", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:86199646-f7aa-53d2-bbae-43546182fd7d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-41080 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-41080 (Open Redirect via protocol-relative URLs in FORM authentication) is NOT present in Apache Tomcat 10.1.50. The fix was already included in the upstream Apache Tomcat 10.1.50 release (commit bb4624a9f3 by Mark Thomas, dated Aug 22, 2023) before TuxCare onboarded this version. The vulnerable pattern - lack of protection against protocol-relative redirects (URLs starting with //) in...", "justification": "code_not_present" } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:5b7e075d-0133-512e-a27e-00440210d4d0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-42795 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-42795 is NOT present in Tomcat 10.1.50. The upstream fix (commit 9375d67106f by Mark Thomas on 2023-10-05) was already included in the upstream release before TuxCare onboarded version 10.1.50. All four affected recycle() methods (Request.java, ApplicationHttpRequest.java, B2CConverter.java, C2BConverter.java) contain the protective try-catch blocks that prevent exceptions from abortin...", "justification": "code_not_present" } }, { "id": "CVE-2023-45648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:4736721f-b004-5427-80dc-5400e4669b50", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-45648 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 Target version 10.1.50 is NOT AFFECTED by CVE-2023-45648. The upstream Apache Tomcat 10.1.50 release already contained the fix for improper HTTP trailer header validation. The vulnerability (unvalidated trailer headers enabling request smuggling) is not present because the code includes HttpHeaderParser with proper validation that rejects non-token characters in header names and control charact...", "justification": "code_not_present" } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:67de5d64-ddb1-589b-be97-daf0ff276057", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-54677 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2024-54677 affects Apache Tomcat's examples web application (SessionExample servlet) through uncontrolled resource consumption. The vulnerability allowed unlimited session attributes to be created, exhausting server memory. The target repository version 10.1.50 is not affected because the fix (SESSION_ATTRIBUTE_COUNT_LIMIT = 10) was already present in the upstream Apache Tomcat 10.1.50 rele...", "justification": "code_not_present" } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:24afdcc1-ca77-57fd-b04d-7a051f2e717e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:eb1bb52c-2bb1-5fc7-b502-53437167cdb0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55752 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:75fa129b-6532-55ba-92a2-de81b0292e0c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:0b95b04b-16bf-58e6-b5a0-c89e7caa2ad4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-61795 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 The target Tomcat 10.1.50 is NOT AFFECTED by CVE-2025-61795. The vulnerability (temporary file accumulation from failed multipart uploads) has been fixed by upstream Apache Tomcat. The fix commit af6e918162 by Mark Thomas (markt@apache.org) was included in the upstream 10.1.50 release that TuxCare onboarded. The CVE states versions 10.1.47+ are fixed, and 10.1.50 meets this requirement. The def...", "justification": "code_not_present" } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:5b321ea1-0a98-57ef-ad57-675b1ce02ccc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66614 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:b6debb13-96e2-5f9d-8d62-a2db68f3a285", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-29129", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:7126c343-4d0c-5410-a30f-825bfaa35d7f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-29129 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:5bff13a5-d5da-5f2c-bfcb-516a72ed26e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:2ed6cf18-92b8-5f4d-99aa-77f3ab9ada70", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:0a5c5129-7e26-55a0-95c8-22bd60ee989a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32990 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:6594ef16-3ec1-517b-b321-7d75a8c937a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-34486", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:d1fbb9b4-8296-5ff0-a01f-3ff46bf844a3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34486 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:2d509a6c-1387-5501-afee-bf22cd63e7a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34487 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:bdd63a78-2fac-5664-825c-eb458f1edba1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:2b59b8b2-9c95-59aa-b99c-27e46c83dc63", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:224818e1-41e4-5282-ab64-bdcb5c2ae1bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:826d102c-5b14-5b78-8959-d77a087a2241", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:0566d692-694c-5f67-b959-b62692b3e56e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43513 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:584bacab-4f32-535b-b6e3-5a9e11409792", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:499f7a76-4da5-58e9-82bf-dc42be780f0a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43515 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:b214cd8b-bfde-5701-8535-72db99103b3d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65182 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:a6167603-f44d-5b4d-86bc-0ac8a482431f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65905 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:87307fa5-77d3-5df3-bd2b-52cfdbb1cf3e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.2" } ] }