{
  "@id": "urn:uuid:b56ab156-e5e6-4d25-8441-7267c3008b38",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 38,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T14:22:27.284985+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2008-1947 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2008-1947"
      },
      "action_statement": "Vulnerability CVE-2008-1947 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T14:21:53.066702+00:00",
      "status_notes": "Vulnerability CVE-2013-4590 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2013-4590"
      },
      "action_statement": "Vulnerability CVE-2013-4590 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T14:21:53.066702+00:00",
      "status_notes": "Vulnerability CVE-2015-5174 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2015-5174"
      },
      "action_statement": "Vulnerability CVE-2015-5174 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T14:22:27.284985+00:00",
      "status_notes": "Vulnerability CVE-2015-5346 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2015-5346"
      },
      "action_statement": "Vulnerability CVE-2015-5346 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T14:21:53.066702+00:00",
      "status_notes": "Vulnerability CVE-2016-0706 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-0706"
      },
      "action_statement": "Vulnerability CVE-2016-0706 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2016-0762 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-0762"
      },
      "action_statement": "Vulnerability CVE-2016-0762 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T14:22:27.284985+00:00",
      "status_notes": "Vulnerability CVE-2016-0763 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-0763"
      },
      "action_statement": "Vulnerability CVE-2016-0763 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2016-6794 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-6794"
      },
      "action_statement": "Vulnerability CVE-2016-6794 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2016-6796 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-6796"
      },
      "action_statement": "Vulnerability CVE-2016-6796 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2016-6797 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-6797"
      },
      "action_statement": "Vulnerability CVE-2016-6797 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T14:21:53.066702+00:00",
      "status_notes": "Vulnerability CVE-2016-6817 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-6817"
      },
      "action_statement": "Vulnerability CVE-2016-6817 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T14:22:27.284985+00:00",
      "status_notes": "Vulnerability CVE-2016-8747 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-8747"
      },
      "action_statement": "Vulnerability CVE-2016-8747 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2017-5647 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2017-5647"
      },
      "action_statement": "Vulnerability CVE-2017-5647 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T14:22:27.284985+00:00",
      "status_notes": "Vulnerability CVE-2017-5650 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2017-5650"
      },
      "action_statement": "Vulnerability CVE-2017-5650 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2017-5664 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2017-5664"
      },
      "action_statement": "Vulnerability CVE-2017-5664 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2017-7674 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2017-7674"
      },
      "action_statement": "Vulnerability CVE-2017-7674 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T14:21:53.066702+00:00",
      "status_notes": "Vulnerability CVE-2017-7675 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2017-7675"
      },
      "action_statement": "Vulnerability CVE-2017-7675 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:37:14.382670+00:00",
      "status_notes": "Vulnerability CVE-2019-0221 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2019-0221"
      },
      "action_statement": "Vulnerability CVE-2019-0221 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2019-17569 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2019-17569"
      },
      "action_statement": "Vulnerability CVE-2019-17569 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2020-11996 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2020-11996"
      },
      "action_statement": "Vulnerability CVE-2020-11996 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2020-13934 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2020-13934"
      },
      "action_statement": "Vulnerability CVE-2020-13934 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2020-13935 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2020-13935"
      },
      "action_statement": "Vulnerability CVE-2020-13935 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:28:44.006786+00:00",
      "status_notes": "Vulnerability CVE-2020-1935 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2020-1935"
      },
      "action_statement": "Vulnerability CVE-2020-1935 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T14:09:00.258382+00:00",
      "status_notes": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat 10.1.18-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2020-8022"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2021-30639 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2021-30639"
      },
      "action_statement": "Vulnerability CVE-2021-30639 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2021-30640 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2021-30640"
      },
      "action_statement": "Vulnerability CVE-2021-30640 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T04:37:00.128383+00:00",
      "status_notes": "Vulnerability CVE-2021-33037 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-33037 affects Apache Tomcat's HTTP transfer-encoding parsing, potentially enabling request smuggling. All three fixes (reject \"identity\" encoding, process Transfer-Encoding from HTTP/1.0, ensure chunked is final encoding) were committed by upstream Apache developer Mark Thomas (markt@apache.org) on 2021-05-10 in commits be8f733b8c, 1692e4e5b1, and c3bd168427. These fixes were already p...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-33037"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-33037 affects Apache Tomcat's HTTP transfer-encoding parsing, potentially enabling request smuggling. All three fixes (reject \"identity\" encoding, process Transfer-Encoding from HTTP/1.0, ensure chunked is final encoding) were committed by upstream Apache developer Mark Thomas (markt@apache.org) on 2021-05-10 in commits be8f733b8c, 1692e4e5b1, and c3bd168427. These fixes were already p..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2021-41079 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2021-41079"
      },
      "action_statement": "Vulnerability CVE-2021-41079 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T21:18:11.261123+00:00",
      "status_notes": "Vulnerability CVE-2021-42340 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2021-42340"
      },
      "action_statement": "Vulnerability CVE-2021-42340 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T01:39:41.907898+00:00",
      "status_notes": "Vulnerability CVE-2021-43980 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 Target version 10.1.18 is not affected by CVE-2021-43980. The vulnerability fix (atomic processor ownership via AtomicReference and takeCurrentProcessor() method) was already present in the upstream Apache Tomcat 10.1.18 release when TuxCare onboarded it. The fix prevents the concurrency bug where multiple threads could share the same Http11Processor instance, causing responses to be delivered ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-43980"
      },
      "impact_statement": "not_affected \u2014 Target version 10.1.18 is not affected by CVE-2021-43980. The vulnerability fix (atomic processor ownership via AtomicReference and takeCurrentProcessor() method) was already present in the upstream Apache Tomcat 10.1.18 release when TuxCare onboarded it. The fix prevents the concurrency bug where multiple threads could share the same Http11Processor instance, causing responses to be delivered ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T21:19:00.657885+00:00",
      "status_notes": "Vulnerability CVE-2022-23181 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2022-23181"
      },
      "action_statement": "Vulnerability CVE-2022-23181 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2022-25762 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2022-25762"
      },
      "action_statement": "Vulnerability CVE-2022-25762 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T21:16:19.887305+00:00",
      "status_notes": "Vulnerability CVE-2022-29885 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2022-29885"
      },
      "action_statement": "Vulnerability CVE-2022-29885 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T01:28:48.786102+00:00",
      "status_notes": "Vulnerability CVE-2022-34305 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2022-34305 XSS vulnerability is not present in Apache Tomcat 10.1.18. The upstream fix by Mark Thomas (markt@apache.org) that adds util.HTMLFilter.filter() to sanitize user-controlled output was already included in the Apache Tomcat 10.1.18 release that TuxCare onboarded. All user-provided data (principal attributes and session attributes) is properly HTML-escaped before rendering in the Fo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-34305"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-34305 XSS vulnerability is not present in Apache Tomcat 10.1.18. The upstream fix by Mark Thomas (markt@apache.org) that adds util.HTMLFilter.filter() to sanitize user-controlled output was already included in the Apache Tomcat 10.1.18 release that TuxCare onboarded. All user-provided data (principal attributes and session attributes) is properly HTML-escaped before rendering in the Fo..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T00:49:00.093458+00:00",
      "status_notes": "Vulnerability CVE-2023-41080 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-41080 (Open Redirect via protocol-relative URLs in FORM authentication) is NOT present in Apache Tomcat 10.1.18. The upstream fix from commit bb4624a9f3e (by Mark Thomas, 2023-08-22) was already included in the Apache Tomcat 10.1.13+ release series. When TuxCare onboarded version 10.1.18, the fix was already present in the upstream code. The defense code at FormAuthenticator.java:765-7...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-41080"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-41080 (Open Redirect via protocol-relative URLs in FORM authentication) is NOT present in Apache Tomcat 10.1.18. The upstream fix from commit bb4624a9f3e (by Mark Thomas, 2023-08-22) was already included in the Apache Tomcat 10.1.13+ release series. When TuxCare onboarded version 10.1.18, the fix was already present in the upstream code. The defense code at FormAuthenticator.java:765-7..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T18:21:18.934330+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 The target repository (Apache Tomcat 10.1.18-tuxcare.9) is NOT affected by CVE-2023-42795. The fix for this incomplete cleanup vulnerability was already present in the upstream Apache Tomcat 10.1.18 release, which TuxCare onboarded. All vulnerable recycle() methods identified in the vendor patches have been hardened with proper exception handling to prevent information leakage between requests.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-42795"
      },
      "impact_statement": "not_affected \u2014 The target repository (Apache Tomcat 10.1.18-tuxcare.9) is NOT affected by CVE-2023-42795. The fix for this incomplete cleanup vulnerability was already present in the upstream Apache Tomcat 10.1.18 release, which TuxCare onboarded. All vulnerable recycle() methods identified in the vendor patches have been hardened with proper exception handling to prevent information leakage between requests."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T19:06:21.253116+00:00",
      "status_notes": "Vulnerability CVE-2023-45648 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-45648 (HTTP trailer header parsing vulnerability) is NOT present in Tomcat 10.1.18. The target version includes the upstream fix that was released in Tomcat 10.1.14. The fix adds strict validation to reject trailer headers with non-token characters in names and control characters (except tab) in values, preventing request smuggling attacks. This fix was authored by Mark Thomas (Apache ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45648"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-45648 (HTTP trailer header parsing vulnerability) is NOT present in Tomcat 10.1.18. The target version includes the upstream fix that was released in Tomcat 10.1.14. The fix adds strict validation to reject trailer headers with non-token characters in names and control characters (except tab) in values, preventing request smuggling attacks. This fix was authored by Mark Thomas (Apache ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-54677 is fixed in version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2024-54677"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-49124 is fixed in version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-49124"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55752 is fixed in version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-55752"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55754 is fixed in version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-55754"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-61795 is fixed in version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-61795"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T15:04:48.533600+00:00",
      "status_notes": "Vulnerability CVE-2025-66614 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 10.1.18-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2025-66614"
      },
      "action_statement": "Vulnerability CVE-2025-66614 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 10.1.18-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-25854 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 10.1.18-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-25854"
      },
      "action_statement": "Vulnerability CVE-2026-25854 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 10.1.18-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2026-29129 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-29129"
      },
      "action_statement": "Vulnerability CVE-2026-29129 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-29145 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 10.1.18-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-29145"
      },
      "action_statement": "Vulnerability CVE-2026-29145 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 10.1.18-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-29146 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 10.1.18-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-29146"
      },
      "action_statement": "Vulnerability CVE-2026-29146 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 10.1.18-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-32990 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-32990"
      },
      "action_statement": "Vulnerability CVE-2026-32990 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34483 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 10.1.18-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-34483"
      },
      "action_statement": "Vulnerability CVE-2026-34483 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 10.1.18-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34486 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 10.1.18-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-34486"
      },
      "action_statement": "Vulnerability CVE-2026-34486 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 10.1.18-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34487 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 10.1.18-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-34487"
      },
      "action_statement": "Vulnerability CVE-2026-34487 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 10.1.18-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T15:04:48.533600+00:00",
      "status_notes": "Vulnerability CVE-2026-41284 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 10.1.18-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-41284"
      },
      "action_statement": "Vulnerability CVE-2026-41284 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 10.1.18-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T15:04:48.533600+00:00",
      "status_notes": "Vulnerability CVE-2026-41293 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 10.1.18-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-41293"
      },
      "action_statement": "Vulnerability CVE-2026-41293 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 10.1.18-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T15:04:48.533600+00:00",
      "status_notes": "Vulnerability CVE-2026-42498 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 10.1.18-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-42498"
      },
      "action_statement": "Vulnerability CVE-2026-42498 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 10.1.18-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T21:33:00.121568+00:00",
      "status_notes": "Vulnerability CVE-2026-43512 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 10.1.18-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-43512"
      },
      "action_statement": "Vulnerability CVE-2026-43512 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 10.1.18-tuxcare.9."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43513 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43513"
      },
      "action_statement": "Vulnerability CVE-2026-43513 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43514 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43514"
      },
      "action_statement": "Vulnerability CVE-2026-43514 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T15:04:48.533600+00:00",
      "status_notes": "Vulnerability CVE-2026-43515 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 10.1.18-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-43515"
      },
      "action_statement": "Vulnerability CVE-2026-43515 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 10.1.18-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T15:04:48.533600+00:00",
      "status_notes": "Vulnerability CVE-2026-65182 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 10.1.18-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-65182"
      },
      "action_statement": "Vulnerability CVE-2026-65182 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 10.1.18-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-65905 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-65905"
      },
      "action_statement": "Vulnerability CVE-2026-65905 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-68525 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 10.1.18-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-68525"
      },
      "action_statement": "Vulnerability CVE-2026-68525 affects version 10.1.18-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 10.1.18-tuxcare.7."
    }
  ]
}