{
  "@id": "urn:uuid:26df67be-4947-4558-ad91-9b0e0778f4af",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 33,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T01:41:00.152640+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2008-1947 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2008-1947"
      },
      "action_statement": "Vulnerability CVE-2008-1947 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T11:03:11.209964+00:00",
      "status_notes": "Vulnerability CVE-2013-4590 does not affect version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat. Tomcat 7.0.109 is not vulnerable as it is outside the affected ranges: [0, 6.0.37]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2013-4590"
      },
      "impact_statement": "Tomcat 7.0.109 is not vulnerable as it is outside the affected ranges: [0, 6.0.37]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2015-5174 does not affect version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2015-5174 is not present in Tomcat 7.0.109-tuxcare.4. The upstream Apache fix (commit 90ca468fc6, April 2016) was already included in the official Tomcat 7.0.109 release (April 2021) before TuxCare adopted the repository. The fix uses an alternative approach (addedTrailingSlash logic) compared to the trunk patch (78688b0a30), but achieves the same security goal by preventing directory trave...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5174"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-5174 is not present in Tomcat 7.0.109-tuxcare.4. The upstream Apache fix (commit 90ca468fc6, April 2016) was already included in the official Tomcat 7.0.109 release (April 2021) before TuxCare adopted the repository. The fix uses an alternative approach (addedTrailingSlash logic) compared to the trunk patch (78688b0a30), but achieves the same security goal by preventing directory trave..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2015-5346 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2015-5346"
      },
      "action_statement": "Vulnerability CVE-2015-5346 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T11:03:11.209964+00:00",
      "status_notes": "Vulnerability CVE-2016-0706 does not affect version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat. Tomcat 7.0.109 is not vulnerable as it is outside the affected ranges: [6.0.0, 6.0.45), [8.0.0.RC1, 8.0.31), [9.0.0.M1, 9.0.0.M2)",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-0706"
      },
      "impact_statement": "Tomcat 7.0.109 is not vulnerable as it is outside the affected ranges: [6.0.0, 6.0.45), [8.0.0.RC1, 8.0.31), [9.0.0.M1, 9.0.0.M2)"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2016-0762 does not affect version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0762 describes a timing attack vulnerability in Apache Tomcat Realm implementations (versions 7.0.0-7.0.70) where passwords were not processed when usernames didn't exist, allowing attackers to enumerate valid usernames through timing analysis. The target version (7.0.109-tuxcare.4) already contains the upstream Apache fix from August 2016 (commit 970e615c7a by Mark Thomas, first relea...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-0762"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-0762 describes a timing attack vulnerability in Apache Tomcat Realm implementations (versions 7.0.0-7.0.70) where passwords were not processed when usernames didn't exist, allowing attackers to enumerate valid usernames through timing analysis. The target version (7.0.109-tuxcare.4) already contains the upstream Apache fix from August 2016 (commit 970e615c7a by Mark Thomas, first relea..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2016-0763 does not affect version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat. CVE-2016-0763 affects Apache Tomcat 7.0.0-7.0.67",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-0763"
      },
      "impact_statement": "CVE-2016-0763 affects Apache Tomcat 7.0.0-7.0.67"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2016-6794 does not affect version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat. CVE-2016-6794 affects Apache Tomcat 7.0.0-7.0.70",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-6794"
      },
      "impact_statement": "CVE-2016-6794 affects Apache Tomcat 7.0.0-7.0.70"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2016-6796 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-6796"
      },
      "action_statement": "Vulnerability CVE-2016-6796 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2016-6797 does not affect version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat. CVE-2016-6797 does not affect Tomcat 7.0.109-tuxcare.4. The vulnerability, which allowed web applications to access any global JNDI resource without explicit ResourceLink configuration, was fixed by upstream Apache in version 7.0.71 (released August 2016). The CVE affects versions 7.0.0 to 7.0.70. The target version (7.0.109) inherited the fix from the upstream Apache Tomcat distribution. The fix is present and fully functional in the target code.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-6797"
      },
      "impact_statement": "CVE-2016-6797 does not affect Tomcat 7.0.109-tuxcare.4. The vulnerability, which allowed web applications to access any global JNDI resource without explicit ResourceLink configuration, was fixed by upstream Apache in version 7.0.71 (released August 2016). The CVE affects versions 7.0.0 to 7.0.70. The target version (7.0.109) inherited the fix from the upstream Apache Tomcat distribution. The fix is present and fully functional in the target code."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2016-6817 does not affect version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat. Version 7.0.109 is not vulnerable. Summary: Target repository is Tomcat 7.0.109-tuxcare.1, which does not have HTTP/2 support. CVE-2016-6817 affects the HTTP/2 header parser in Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6. Since HTTP/2 support was first introduced in Tomcat 8.5 and 9.0, and the target is running Tomcat 7.0.x, the vulnerable component (java/org/apache/coyote/http2/Http2Parser.java) does not exist in this codebase. Therefore, the vulnerability cannot exist.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-6817"
      },
      "impact_statement": "Version 7.0.109 is not vulnerable. Summary: Target repository is Tomcat 7.0.109-tuxcare.1, which does not have HTTP/2 support. CVE-2016-6817 affects the HTTP/2 header parser in Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6. Since HTTP/2 support was first introduced in Tomcat 8.5 and 9.0, and the target is running Tomcat 7.0.x, the vulnerable component (java/org/apache/coyote/http2/Http2Parser.java) does not exist in this codebase. Therefore, the vulnerability cannot exist."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2016-8747 does not affect version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat. Version 7.0.109 is not vulnerable. Summary: CVE-2016-8747 does not affect the target repository. The target is Tomcat 7.0.109, which uses a fundamentally different architecture (byte arrays with System.arraycopy) that predates the vulnerable ByteBuffer refactoring introduced in Tomcat 8.5.7. The vulnerable class Http11InputBuffer.java does not exist in Tomcat 7.x.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-8747"
      },
      "impact_statement": "Version 7.0.109 is not vulnerable. Summary: CVE-2016-8747 does not affect the target repository. The target is Tomcat 7.0.109, which uses a fundamentally different architecture (byte arrays with System.arraycopy) that predates the vulnerable ByteBuffer refactoring introduced in Tomcat 8.5.7. The vulnerable class Http11InputBuffer.java does not exist in Tomcat 7.x."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2017-5647 does not affect version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat. CVE-2017-5647 affects Apache Tomcat 7.0.0-7.0.76",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5647"
      },
      "impact_statement": "CVE-2017-5647 affects Apache Tomcat 7.0.0-7.0.76"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2017-5650 does not affect version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat. Version 7.0.109 is not vulnerable. Summary: Target repository (Apache Tomcat 7.0.109) does not contain HTTP/2 implementation. CVE-2017-5650 affects HTTP/2 GOAWAY frame handling in Tomcat 8.5.0-8.5.12 and 9.0.0.M1-9.0.0.M18. HTTP/2 support was first introduced in Tomcat 8.5.0, so Tomcat 7.x completely predates the vulnerable feature.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5650"
      },
      "impact_statement": "Version 7.0.109 is not vulnerable. Summary: Target repository (Apache Tomcat 7.0.109) does not contain HTTP/2 implementation. CVE-2017-5650 affects HTTP/2 GOAWAY frame handling in Tomcat 8.5.0-8.5.12 and 9.0.0.M1-9.0.0.M18. HTTP/2 support was first introduced in Tomcat 8.5.0, so Tomcat 7.x completely predates the vulnerable feature."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2017-5664 does not affect version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat. CVE-2017-5664 is NOT present in Tomcat 7.0.109-tuxcare.4. The vulnerability was fixed by upstream Apache in commit 58b32048 (May 2017) before the 7.0.109 release. TuxCare inherited this fix when onboarding version 7.0.109. Both DefaultServlet and WebdavServlet now properly force error dispatches through doGet() regardless of the original HTTP method, preventing modification/deletion of static error pages via PUT/DELETE requests.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5664"
      },
      "impact_statement": "CVE-2017-5664 is NOT present in Tomcat 7.0.109-tuxcare.4. The vulnerability was fixed by upstream Apache in commit 58b32048 (May 2017) before the 7.0.109 release. TuxCare inherited this fix when onboarding version 7.0.109. Both DefaultServlet and WebdavServlet now properly force error dispatches through doGet() regardless of the original HTTP method, preventing modification/deletion of static error pages via PUT/DELETE requests."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T14:27:56.082717+00:00",
      "status_notes": "Vulnerability CVE-2017-7674 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat, and is fixed in 7.0.109-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2017-7674"
      },
      "action_statement": "Vulnerability CVE-2017-7674 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat, and is fixed in 7.0.109-tuxcare.5."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2017-7675 does not affect version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat. Version 7.0.109 is not vulnerable. Summary: Target repository is Tomcat 7.0.109, which does not contain HTTP/2 support. The vulnerability CVE-2017-7675 is specific to the HTTP/2 implementation that was introduced in Tomcat 8.5.0 and 9.0.0.M1. Since the vulnerable feature (HTTP/2) was never introduced in Tomcat 7.x, the target is not vulnerable.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7675"
      },
      "impact_statement": "Version 7.0.109 is not vulnerable. Summary: Target repository is Tomcat 7.0.109, which does not contain HTTP/2 support. The vulnerability CVE-2017-7675 is specific to the HTTP/2 implementation that was introduced in Tomcat 8.5.0 and 9.0.0.M1. Since the vulnerable feature (HTTP/2) was never introduced in Tomcat 7.x, the target is not vulnerable."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:37:14.382670+00:00",
      "status_notes": "Vulnerability CVE-2019-0221 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2019-0221"
      },
      "action_statement": "Vulnerability CVE-2019-0221 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2019-17569 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2019-17569"
      },
      "action_statement": "Vulnerability CVE-2019-17569 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-11996 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2020-11996"
      },
      "action_statement": "Vulnerability CVE-2020-11996 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-13934 does not affect version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat. CVE-2020-13934 affects Apache Tomcat 8.5.1-8.5.56 and 9.0.0.M5-9.0.36 only; 7.0.x is not affected",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-13934"
      },
      "impact_statement": "CVE-2020-13934 affects Apache Tomcat 8.5.1-8.5.56 and 9.0.0.M5-9.0.36 only; 7.0.x is not affected"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:49:59.024011+00:00",
      "status_notes": "Vulnerability CVE-2020-13935 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2020-13935"
      },
      "action_statement": "Vulnerability CVE-2020-13935 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:28:44.006786+00:00",
      "status_notes": "Vulnerability CVE-2020-1935 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2020-1935"
      },
      "action_statement": "Vulnerability CVE-2020-1935 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat 7.0.109-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2020-8022"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-30639 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2021-30639"
      },
      "action_statement": "Vulnerability CVE-2021-30639 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:49:59.024011+00:00",
      "status_notes": "Vulnerability CVE-2021-30640 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2021-30640"
      },
      "action_statement": "Vulnerability CVE-2021-30640 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T21:22:31.131193+00:00",
      "status_notes": "Vulnerability CVE-2021-33037 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2021-33037"
      },
      "action_statement": "Vulnerability CVE-2021-33037 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:49:59.024011+00:00",
      "status_notes": "Vulnerability CVE-2021-41079 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2021-41079"
      },
      "action_statement": "Vulnerability CVE-2021-41079 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T14:27:21.818338+00:00",
      "status_notes": "Vulnerability CVE-2021-42340 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat, and is fixed in 7.0.109-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2021-42340"
      },
      "action_statement": "Vulnerability CVE-2021-42340 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat, and is fixed in 7.0.109-tuxcare.5."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T01:41:00.152640+00:00",
      "status_notes": "Vulnerability CVE-2021-43980 does not affect version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 Tomcat 7.0.109 is not affected by CVE-2021-43980. The vulnerability is specific to an architectural change introduced in Tomcat 10 and back-ported to Tomcat 9.0.47+, where processor-to-socket mapping was moved from a thread-safe ConcurrentHashMap to a non-atomic currentProcessor field in SocketWrapperBase. Tomcat 7.0.109 still uses the older, thread-safe ConcurrentHashMap architecture and does ...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2021-43980"
      },
      "impact_statement": "not_affected \u2014 Tomcat 7.0.109 is not affected by CVE-2021-43980. The vulnerability is specific to an architectural change introduced in Tomcat 10 and back-ported to Tomcat 9.0.47+, where processor-to-socket mapping was moved from a thread-safe ConcurrentHashMap to a non-atomic currentProcessor field in SocketWrapperBase. Tomcat 7.0.109 still uses the older, thread-safe ConcurrentHashMap architecture and does ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-23181 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat, and is fixed in 7.0.109-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2022-23181"
      },
      "action_statement": "Vulnerability CVE-2022-23181 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat, and is fixed in 7.0.109-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:49:59.024011+00:00",
      "status_notes": "Vulnerability CVE-2022-25762 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2022-25762"
      },
      "action_statement": "Vulnerability CVE-2022-25762 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T21:16:19.887305+00:00",
      "status_notes": "Vulnerability CVE-2022-29885 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2022-29885"
      },
      "action_statement": "Vulnerability CVE-2022-29885 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-34305 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat, and is fixed in 7.0.109-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2022-34305"
      },
      "action_statement": "Vulnerability CVE-2022-34305 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat, and is fixed in 7.0.109-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T21:07:35.663971+00:00",
      "status_notes": "Vulnerability CVE-2023-41080 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2023-41080"
      },
      "action_statement": "Vulnerability CVE-2023-41080 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:11:01.360398+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2023-42795"
      },
      "action_statement": "Vulnerability CVE-2023-42795 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:11:36.374923+00:00",
      "status_notes": "Vulnerability CVE-2023-45648 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2023-45648"
      },
      "action_statement": "Vulnerability CVE-2023-45648 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:11:36.374923+00:00",
      "status_notes": "Vulnerability CVE-2024-54677 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2024-54677"
      },
      "action_statement": "Vulnerability CVE-2024-54677 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:12:53.572239+00:00",
      "status_notes": "Vulnerability CVE-2025-49124 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-49124"
      },
      "action_statement": "Vulnerability CVE-2025-49124 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:12:53.572239+00:00",
      "status_notes": "Vulnerability CVE-2025-55752 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-55752"
      },
      "action_statement": "Vulnerability CVE-2025-55752 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:11:01.360398+00:00",
      "status_notes": "Vulnerability CVE-2025-55754 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-55754"
      },
      "action_statement": "Vulnerability CVE-2025-55754 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:12:53.572239+00:00",
      "status_notes": "Vulnerability CVE-2025-61795 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-61795"
      },
      "action_statement": "Vulnerability CVE-2025-61795 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-66614 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-66614"
      },
      "action_statement": "Vulnerability CVE-2025-66614 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T20:01:16.621327+00:00",
      "status_notes": "Vulnerability CVE-2026-25854 does not affect version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 Target Apache Tomcat 7.0.109 is not affected by CVE-2026-25854. The vulnerable component LoadBalancerDrainingValve does not exist in this version. The valve was introduced in Tomcat 8.5.30 (backport on 2018-03-29), 9.0.0-M23 (original on 2017-06-21), and later versions. Version 7.0.109 predates the introduction of this component entirely.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-25854"
      },
      "impact_statement": "not_affected \u2014 Target Apache Tomcat 7.0.109 is not affected by CVE-2026-25854. The vulnerable component LoadBalancerDrainingValve does not exist in this version. The valve was introduced in Tomcat 8.5.30 (backport on 2018-03-29), 9.0.0-M23 (original on 2017-06-21), and later versions. Version 7.0.109 predates the introduction of this component entirely."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2026-29129 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-29129"
      },
      "action_statement": "Vulnerability CVE-2026-29129 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-29145 does not affect version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat. The official CVE record (https://www.cve.org/CVERecord?id=CVE-2026-29145) limits the affected versions to Apache Tomcat 9.0.13\u20139.0.115, 10.1.0-M7\u201310.1.52, and 11.0.0-M1\u201311.0.18. Version 7.0.109 is not within any of these ranges",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-29145"
      },
      "impact_statement": "The official CVE record (https://www.cve.org/CVERecord?id=CVE-2026-29145) limits the affected versions to Apache Tomcat 9.0.13\u20139.0.115, 10.1.0-M7\u201310.1.52, and 11.0.0-M1\u201311.0.18. Version 7.0.109 is not within any of these ranges"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-29146 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat, and is fixed in 7.0.109-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-29146"
      },
      "action_statement": "Vulnerability CVE-2026-29146 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat, and is fixed in 7.0.109-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-32990 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-32990"
      },
      "action_statement": "Vulnerability CVE-2026-32990 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:12:53.572239+00:00",
      "status_notes": "Vulnerability CVE-2026-34483 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-34483"
      },
      "action_statement": "Vulnerability CVE-2026-34483 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34486 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat, and is fixed in 7.0.109-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-34486"
      },
      "action_statement": "Vulnerability CVE-2026-34486 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat, and is fixed in 7.0.109-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:10:34.135169+00:00",
      "status_notes": "Vulnerability CVE-2026-34487 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-34487"
      },
      "action_statement": "Vulnerability CVE-2026-34487 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41284 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-41284"
      },
      "action_statement": "Vulnerability CVE-2026-41284 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41293 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-41293"
      },
      "action_statement": "Vulnerability CVE-2026-41293 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42498 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-42498"
      },
      "action_statement": "Vulnerability CVE-2026-42498 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43512 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43512"
      },
      "action_statement": "Vulnerability CVE-2026-43512 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43513 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43513"
      },
      "action_statement": "Vulnerability CVE-2026-43513 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43514 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43514"
      },
      "action_statement": "Vulnerability CVE-2026-43514 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43515 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43515"
      },
      "action_statement": "Vulnerability CVE-2026-43515 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-65182 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-65182"
      },
      "action_statement": "Vulnerability CVE-2026-65182 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-65905 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-65905"
      },
      "action_statement": "Vulnerability CVE-2026-65905 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-68525 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-68525"
      },
      "action_statement": "Vulnerability CVE-2026-68525 affects version 7.0.109-tuxcare.1 of org.apache.tomcat:tomcat."
    }
  ]
}