Vulnerability Overview
Exploitation Activity
Exploitation Intelligence
CISA has added critical vulnerabilities in IBM Langflow, Apache Tomcat, and N-able N-central to its Known Exploited Vulnerabilities catalog, with a deadline for federal agencies to patch by August 7, 2026. The Langflow flaw (CVE-2026-9198) allows remote code execution, while the Tomcat flaw (CVE-202...
A vulnerability in Apache Tomcat, tracked as CVE-2026-34486, allows unauthenticated remote code execution due to a flaw in the EncryptInterceptor that bypasses encryption checks. This flaw was introduced by a code refactor on March 13, 2026, which moved a line of code, changing the encryption layer'...
On July 28, 2026, Oracle released important security fixes for Tomcat versions 9 and 10, addressing multiple vulnerabilities. Key issues include CVE-2026-24734, a certificate revocation bypass, and CVE-2026-29146, which exposes sensitive data due to a padding oracle vulnerability in the EncryptInter...
Two critical vulnerabilities have been identified in Apache Tomcat, CVE-2026-34486 and CVE-2026-29146. CVE-2026-34486 allows bypassing of the EncryptInterceptor due to missing encryption of sensitive data, affecting versions 11.0.20, 10.1.53, and 9.0.116. CVE-2026-29146 is a Padding Oracle vulnerabi...
