{ "@id": "urn:uuid:d0a8395c-17e7-4334-be16-a16148e2a8fb", "role": "Document Creator", "author": "https://tuxcare.com", "version": 46, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-30T14:49:00.106665+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability CVE-2008-1947 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2008-1947" }, "action_statement": "Vulnerability CVE-2008-1947 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-30T14:22:27.284985+00:00", "status_notes": "Vulnerability CVE-2013-4590 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2013-4590" }, "action_statement": "Vulnerability CVE-2013-4590 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-30T14:22:27.284985+00:00", "status_notes": "Vulnerability CVE-2015-5174 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2015-5174" }, "action_statement": "Vulnerability CVE-2015-5174 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-30T14:23:00.531536+00:00", "status_notes": "Vulnerability CVE-2015-5346 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2015-5346" }, "action_statement": "Vulnerability CVE-2015-5346 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-30T14:22:27.284985+00:00", "status_notes": "Vulnerability CVE-2016-0706 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2016-0706" }, "action_statement": "Vulnerability CVE-2016-0706 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2016-0762 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2016-0762" }, "action_statement": "Vulnerability CVE-2016-0762 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-30T14:22:27.284985+00:00", "status_notes": "Vulnerability CVE-2016-0763 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2016-0763" }, "action_statement": "Vulnerability CVE-2016-0763 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2016-6794 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2016-6794" }, "action_statement": "Vulnerability CVE-2016-6794 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2016-6796 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2016-6796" }, "action_statement": "Vulnerability CVE-2016-6796 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2016-6797 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2016-6797" }, "action_statement": "Vulnerability CVE-2016-6797 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-30T14:21:53.066702+00:00", "status_notes": "Vulnerability CVE-2016-6817 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2016-6817" }, "action_statement": "Vulnerability CVE-2016-6817 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-30T14:22:27.284985+00:00", "status_notes": "Vulnerability CVE-2016-8747 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2016-8747" }, "action_statement": "Vulnerability CVE-2016-8747 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2017-5647 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2017-5647" }, "action_statement": "Vulnerability CVE-2017-5647 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-30T14:22:27.284985+00:00", "status_notes": "Vulnerability CVE-2017-5650 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2017-5650" }, "action_statement": "Vulnerability CVE-2017-5650 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2017-5664 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2017-5664" }, "action_statement": "Vulnerability CVE-2017-5664 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2017-7674 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2017-7674" }, "action_statement": "Vulnerability CVE-2017-7674 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-30T14:21:53.066702+00:00", "status_notes": "Vulnerability CVE-2017-7675 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2017-7675" }, "action_statement": "Vulnerability CVE-2017-7675 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T23:37:14.382670+00:00", "status_notes": "Vulnerability CVE-2019-0221 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2019-0221" }, "action_statement": "Vulnerability CVE-2019-0221 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability CVE-2019-17569 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2019-17569" }, "action_statement": "Vulnerability CVE-2019-17569 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T23:49:59.024011+00:00", "status_notes": "Vulnerability CVE-2020-11996 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2020-11996" }, "action_statement": "Vulnerability CVE-2020-11996 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T23:49:59.024011+00:00", "status_notes": "Vulnerability CVE-2020-13934 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2020-13934" }, "action_statement": "Vulnerability CVE-2020-13934 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T23:49:59.024011+00:00", "status_notes": "Vulnerability CVE-2020-13935 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2020-13935" }, "action_statement": "Vulnerability CVE-2020-13935 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability CVE-2020-1935 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2020-1935" }, "action_statement": "Vulnerability CVE-2020-1935 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-30T14:10:00.131690+00:00", "status_notes": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat 10.1.55-tuxcare.1.", "vulnerability": { "name": "CVE-2020-8022" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T23:49:59.024011+00:00", "status_notes": "Vulnerability CVE-2021-30639 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2021-30639" }, "action_statement": "Vulnerability CVE-2021-30639 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T23:49:59.024011+00:00", "status_notes": "Vulnerability CVE-2021-30640 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2021-30640" }, "action_statement": "Vulnerability CVE-2021-30640 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-30T04:44:00.065754+00:00", "status_notes": "Vulnerability CVE-2021-33037 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 10.1.55 is not affected by CVE-2021-33037. The vulnerability involves HTTP request smuggling through three distinct Transfer-Encoding header parsing flaws that allowed desynchronization between reverse proxy and backend. All three upstream fixes were applied by Mark Thomas (markt@apache.org) on May 10, 2021, and shipped in the upstream Apache Tomcat 10.1.55 release that TuxCare su...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-33037" }, "impact_statement": "not_affected \u2014 Apache Tomcat 10.1.55 is not affected by CVE-2021-33037. The vulnerability involves HTTP request smuggling through three distinct Transfer-Encoding header parsing flaws that allowed desynchronization between reverse proxy and backend. All three upstream fixes were applied by Mark Thomas (markt@apache.org) on May 10, 2021, and shipped in the upstream Apache Tomcat 10.1.55 release that TuxCare su..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T23:49:59.024011+00:00", "status_notes": "Vulnerability CVE-2021-41079 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2021-41079" }, "action_statement": "Vulnerability CVE-2021-41079 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T21:18:11.261123+00:00", "status_notes": "Vulnerability CVE-2021-42340 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2021-42340" }, "action_statement": "Vulnerability CVE-2021-42340 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-30T01:45:09.863951+00:00", "status_notes": "Vulnerability CVE-2021-43980 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-43980 fix was already present in upstream Apache Tomcat 10.1.55 release. The vulnerability involved a concurrency bug where non-atomic access to processor-wrapper mappings allowed multiple threads to share a single Http11Processor instance, causing response data to be delivered to wrong clients. The fix (commit 17f177eeb7 by markt@apache.org, March 29, 2022) implemented atomic ownershi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43980" }, "impact_statement": "not_affected \u2014 CVE-2021-43980 fix was already present in upstream Apache Tomcat 10.1.55 release. The vulnerability involved a concurrency bug where non-atomic access to processor-wrapper mappings allowed multiple threads to share a single Http11Processor instance, causing response data to be delivered to wrong clients. The fix (commit 17f177eeb7 by markt@apache.org, March 29, 2022) implemented atomic ownershi..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T21:20:09.538096+00:00", "status_notes": "Vulnerability CVE-2022-23181 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2022-23181" }, "action_statement": "Vulnerability CVE-2022-23181 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T23:49:59.024011+00:00", "status_notes": "Vulnerability CVE-2022-25762 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2022-25762" }, "action_statement": "Vulnerability CVE-2022-25762 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T21:16:19.887305+00:00", "status_notes": "Vulnerability CVE-2022-29885 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2022-29885" }, "action_statement": "Vulnerability CVE-2022-29885 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-30T01:31:00.193594+00:00", "status_notes": "Vulnerability CVE-2022-34305 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 The target (Apache Tomcat 10.1.55) is not affected by CVE-2022-34305. The XSS vulnerability in the Form authentication example was fixed by upstream commit d6251d1cfb (authored by markt@apache.org), which added HTML entity encoding via util.HTMLFilter.filter() to all user-controlled outputs in webapps/examples/jsp/security/protected/index.jsp. This fix was included in upstream release 10.1.0-M1...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-34305" }, "impact_statement": "not_affected \u2014 The target (Apache Tomcat 10.1.55) is not affected by CVE-2022-34305. The XSS vulnerability in the Form authentication example was fixed by upstream commit d6251d1cfb (authored by markt@apache.org), which added HTML entity encoding via util.HTMLFilter.filter() to all user-controlled outputs in webapps/examples/jsp/security/protected/index.jsp. This fix was included in upstream release 10.1.0-M1..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-30T00:55:03.593528+00:00", "status_notes": "Vulnerability CVE-2023-41080 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-41080 (Open Redirect via protocol-relative URLs in FORM authentication) is NOT present in this target. The fix that prevents protocol-relative redirects by removing leading forward slashes from redirect URLs was already included in the upstream Apache Tomcat 10.1.13 release (commit bb4624a9f3e by Mark Thomas, 2023-08-22). Since TuxCare onboarded version 10.1.55 (much later than 10.1.13...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-41080" }, "impact_statement": "not_affected \u2014 CVE-2023-41080 (Open Redirect via protocol-relative URLs in FORM authentication) is NOT present in this target. The fix that prevents protocol-relative redirects by removing leading forward slashes from redirect URLs was already included in the upstream Apache Tomcat 10.1.13 release (commit bb4624a9f3e by Mark Thomas, 2023-08-22). Since TuxCare onboarded version 10.1.55 (much later than 10.1.13..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:27:36.115719+00:00", "status_notes": "Vulnerability CVE-2023-42795 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-42795 (Incomplete Cleanup vulnerability) is not present in Tomcat 10.1.55. The upstream fix by Mark Thomas (commit 9375d67106) was included in the Apache Tomcat 10.1.55 release that TuxCare onboarded. All required defensive changes are present: try-catch blocks in recycle() methods for Request.java, ApplicationHttpRequest.java, B2CConverter.java, and C2BConverter.java ensure cleanup co...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-42795" }, "impact_statement": "not_affected \u2014 CVE-2023-42795 (Incomplete Cleanup vulnerability) is not present in Tomcat 10.1.55. The upstream fix by Mark Thomas (commit 9375d67106) was included in the Apache Tomcat 10.1.55 release that TuxCare onboarded. All required defensive changes are present: try-catch blocks in recycle() methods for Request.java, ApplicationHttpRequest.java, B2CConverter.java, and C2BConverter.java ensure cleanup co..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T19:11:13.689447+00:00", "status_notes": "Vulnerability CVE-2023-45648 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-45648 is NOT present in Tomcat 10.1.55. The vulnerability (improper HTTP trailer header parsing allowing request smuggling) was fixed in the upstream release before TuxCare onboarded it. Tomcat 10.1.55 uses HttpHeaderParser class for trailer parsing, which includes built-in validation that rejects non-token characters in header names (line 141-148) and control characters except tab in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45648" }, "impact_statement": "not_affected \u2014 CVE-2023-45648 is NOT present in Tomcat 10.1.55. The vulnerability (improper HTTP trailer header parsing allowing request smuggling) was fixed in the upstream release before TuxCare onboarded it. Tomcat 10.1.55 uses HttpHeaderParser class for trailer parsing, which includes built-in validation that rejects non-token characters in header names (line 141-148) and control characters except tab in ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2024-54677 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 Target version 10.1.55 is not affected by CVE-2024-54677. The vulnerability affected versions 10.1.0-M1 through 10.1.33, and fixes were released in 10.1.34. Since 10.1.55 > 10.1.34, all upstream fixes are already present in this release. Verified fixes include: 10-attribute session limits in SessionExample.java and JSP examples, shopping cart restriction to pre-defined enum items in DummyCart.j...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-54677" }, "impact_statement": "not_affected \u2014 Target version 10.1.55 is not affected by CVE-2024-54677. The vulnerability affected versions 10.1.0-M1 through 10.1.33, and fixes were released in 10.1.34. Since 10.1.55 > 10.1.34, all upstream fixes are already present in this release. Verified fixes include: 10-attribute session limits in SessionExample.java and JSP examples, shopping cart restriction to pre-defined enum items in DummyCart.j..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:12:53.572239+00:00", "status_notes": "Vulnerability CVE-2025-49124 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2025-49124" }, "action_statement": "Vulnerability CVE-2025-49124 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:12:53.572239+00:00", "status_notes": "Vulnerability CVE-2025-55752 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2025-55752" }, "action_statement": "Vulnerability CVE-2025-55752 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:11:01.360398+00:00", "status_notes": "Vulnerability CVE-2025-55754 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2025-55754" }, "action_statement": "Vulnerability CVE-2025-55754 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T19:18:45.160348+00:00", "status_notes": "Vulnerability CVE-2025-61795 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 Target version 10.1.55 already contains the upstream fix for CVE-2025-61795. The vulnerable pattern (missing immediate cleanup of temporary files after failed multipart uploads) is not present. The fix (commit af6e9181 by Mark Thomas) was shipped in Apache Tomcat's upstream 10.1.55 release, which TuxCare subsequently onboarded. The fix adds explicit `item.delete()` cleanup in a finally block wh...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-61795" }, "impact_statement": "not_affected \u2014 Target version 10.1.55 already contains the upstream fix for CVE-2025-61795. The vulnerable pattern (missing immediate cleanup of temporary files after failed multipart uploads) is not present. The fix (commit af6e9181 by Mark Thomas) was shipped in Apache Tomcat's upstream 10.1.55 release, which TuxCare subsequently onboarded. The fix adds explicit `item.delete()` cleanup in a finally block wh..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:11:01.360398+00:00", "status_notes": "Vulnerability CVE-2025-66614 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2025-66614" }, "action_statement": "Vulnerability CVE-2025-66614 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T20:05:05.196840+00:00", "status_notes": "Vulnerability CVE-2026-25854 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 The target repository (Apache Tomcat 10.1.55) is NOT AFFECTED by CVE-2026-25854. The vulnerability involves an open redirect via LoadBalancerDrainingValve when multiple leading slashes in URIs create protocol-relative URLs. Both required fixes are present in the target: (1) collapseLeadingSlashes() sanitizes URIs at line 211, and (2) sendRedirect() provides validated redirects at line 226. Thes...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25854" }, "impact_statement": "not_affected \u2014 The target repository (Apache Tomcat 10.1.55) is NOT AFFECTED by CVE-2026-25854. The vulnerability involves an open redirect via LoadBalancerDrainingValve when multiple leading slashes in URIs create protocol-relative URLs. Both required fixes are present in the target: (1) collapseLeadingSlashes() sanitizes URIs at line 211, and (2) sendRedirect() provides validated redirects at line 226. Thes..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability CVE-2026-29129 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-29129" }, "action_statement": "Vulnerability CVE-2026-29129 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T21:58:36.804623+00:00", "status_notes": "Vulnerability CVE-2026-29145 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-29145" }, "action_statement": "Vulnerability CVE-2026-29145 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-26T10:52:26.710047+00:00", "status_notes": "Vulnerability CVE-2026-29146 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat. Target version 10.1.55 is not affected by CVE-2026-29146. The CVE affects Apache Tomcat versions through 10.1.52, with fixes shipped in 10.1.53+. The target contains upstream fixes (commits 607ebc0fa5 and 55f3eb9148 by markt@apache.org) that mitigate the padding oracle vulnerability through improved error handling and algorithm validation. The error handling ensures all decryption failures are handled uniformly (message dropped, error logged), preventing attackers from distinguishing padding errors from other decryption failures. Algorithm validation warns users that CBC/PKCS5Padding is not recommended and suggests switching to AES/GCM/NoPadding. Both fixes were present in the upstream 10.1.55 release before TuxCare onboarded it.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-29146" }, "impact_statement": "Target version 10.1.55 is not affected by CVE-2026-29146. The CVE affects Apache Tomcat versions through 10.1.52, with fixes shipped in 10.1.53+. The target contains upstream fixes (commits 607ebc0fa5 and 55f3eb9148 by markt@apache.org) that mitigate the padding oracle vulnerability through improved error handling and algorithm validation. The error handling ensures all decryption failures are handled uniformly (message dropped, error logged), preventing attackers from distinguishing padding errors from other decryption failures. Algorithm validation warns users that CBC/PKCS5Padding is not recommended and suggests switching to AES/GCM/NoPadding. Both fixes were present in the upstream 10.1.55 release before TuxCare onboarded it." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-26T10:52:26.710047+00:00", "status_notes": "Vulnerability CVE-2026-32990 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2026-32990 is NOT present in Apache Tomcat 10.1.55. The fix for this vulnerability (normalizing HTTP Host header to lowercase before SSL configuration lookup) was already included in the upstream Apache Tomcat 10.1.55 release. The target version 10.1.55 is newer than the CVE's affected range (10.1.50-10.1.52), and the fix commit by remm@apache.org is present in HEAD, predating all TuxCare o...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32990" }, "impact_statement": "not_affected \u2014 CVE-2026-32990 is NOT present in Apache Tomcat 10.1.55. The fix for this vulnerability (normalizing HTTP Host header to lowercase before SSL configuration lookup) was already included in the upstream Apache Tomcat 10.1.55 release. The target version 10.1.55 is newer than the CVE's affected range (10.1.50-10.1.52), and the fix commit by remm@apache.org is present in HEAD, predating all TuxCare o..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:12:53.572239+00:00", "status_notes": "Vulnerability CVE-2026-34483 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-34483" }, "action_statement": "Vulnerability CVE-2026-34483 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-30T14:49:00.106665+00:00", "status_notes": "Vulnerability CVE-2026-34486 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-34486" }, "action_statement": "Vulnerability CVE-2026-34486 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:11:01.360398+00:00", "status_notes": "Vulnerability CVE-2026-34487 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-34487" }, "action_statement": "Vulnerability CVE-2026-34487 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:11:36.374923+00:00", "status_notes": "Vulnerability CVE-2026-41284 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-41284" }, "action_statement": "Vulnerability CVE-2026-41284 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:11:01.360398+00:00", "status_notes": "Vulnerability CVE-2026-41293 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-41293" }, "action_statement": "Vulnerability CVE-2026-41293 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:11:01.360398+00:00", "status_notes": "Vulnerability CVE-2026-42498 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-42498" }, "action_statement": "Vulnerability CVE-2026-42498 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2026-43512 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-43512" }, "action_statement": "Vulnerability CVE-2026-43512 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:11:36.374923+00:00", "status_notes": "Vulnerability CVE-2026-43513 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-43513" }, "action_statement": "Vulnerability CVE-2026-43513 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T20:00:39.237106+00:00", "status_notes": "Vulnerability CVE-2026-43514 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2026-43514 (AJP secret timing attack) is NOT present in the target. The vulnerable non-constant-time secret comparison was replaced with constant-time comparison in upstream Apache Tomcat 10.1.55. The fix (commit a102a2a157 by markt@apache.org) shipped in the upstream release before TuxCare onboarded it. The target code at java/org/apache/coyote/ajp/AjpProcessor.java:840 uses ConstantTime.e...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-43514" }, "impact_statement": "not_affected \u2014 CVE-2026-43514 (AJP secret timing attack) is NOT present in the target. The vulnerable non-constant-time secret comparison was replaced with constant-time comparison in upstream Apache Tomcat 10.1.55. The fix (commit a102a2a157 by markt@apache.org) shipped in the upstream release before TuxCare onboarded it. The target code at java/org/apache/coyote/ajp/AjpProcessor.java:840 uses ConstantTime.e..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:12:53.572239+00:00", "status_notes": "Vulnerability CVE-2026-43515 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-43515" }, "action_statement": "Vulnerability CVE-2026-43515 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-26T10:52:26.710047+00:00", "status_notes": "Vulnerability CVE-2026-65182 is fixed in version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-65182" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-26T10:52:26.710047+00:00", "status_notes": "Vulnerability CVE-2026-65905 is fixed in version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-65905" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-26T10:52:33.167508+00:00", "status_notes": "Vulnerability CVE-2026-68525 is fixed in version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-68525" } } ] }