- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 6 · 1 low
- Registry
- Maven Central
Advisories 6
- CVE-2026-111240Unrated
Apache TomEE: Authentication bypass for accounts without a stored password in SQL login module
Affected: from 4.0.0-beta-1, through 4.7.5.
- CVE-2026-111241Unrated
Apache TomEE: Local code execution via predictable passivation files in the shared temporary directory
Affected: from 4.0.0-beta-1, through 4.7.5.
- CVE-2026-87756Unrated
Apache TomEE: Missing authorization on internal deployer EJBs in default profile
Affected: from 4.5.1, through 4.7.5.
- CVE-2026-87755Unrated
Apache TomEE: Stateful session bean hijacking via predictable session identifiers
Affected: from 4.0.0-beta-1, through 4.7.5.
- CVE-2026-86811Unrated
Apache TomEE: Path traversal via stateful EJB passivation
Affected: from 4.0.0-beta-1, through 4.7.5.
Apache TomEE: Username enumeration and timing side channel in JAAS login modules
Affected: from 4.0.0-beta-1, through 4.7.5.