- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 7 · 1 low
- Registry
- Maven Central
Advisories 7
- CVE-2026-86336Unrated
Apache TomEE: EJB method authorization is silently skipped on JDK 21+
Affected: from 10.1.1, fixed in 10.3.0; from 11.0.0-M1, fixed in 11.0.0-M2.
- CVE-2026-111240Unrated
Apache TomEE: Authentication bypass for accounts without a stored password in SQL login module
Affected: from 7.0.0-M1, fixed in 10.0.0-M1; from 10.0.0-M1, fixed in 10.3.0; from 11.0.0-M1, fixed in 11.0.0-M2.
- CVE-2026-111241Unrated
Apache TomEE: Local code execution via predictable passivation files in the shared temporary directory
Affected: from 7.0.0-M1, fixed in 10.0.0-M1; from 10.0.0-M1, fixed in 10.3.0; from 11.0.0-M1, fixed in 11.0.0-M2.
- CVE-2026-87756Unrated
Apache TomEE: Missing authorization on internal deployer EJBs in default profile
Affected: from 7.0.0-M1, fixed in 10.0.0-M1; from 10.0.0-M1, fixed in 10.3.0; from 11.0.0-M1, fixed in 11.0.0-M2.
- CVE-2026-87755Unrated
Apache TomEE: Stateful session bean hijacking via predictable session identifiers
Affected: from 7.0.0-M1, fixed in 10.0.0-M1; from 10.0.0-M1, fixed in 10.3.0; from 11.0.0-M1, fixed in 11.0.0-M2.
- CVE-2026-86811Unrated
Apache TomEE: Path traversal via stateful EJB passivation
Affected: from 7.0.0-M1, fixed in 10.0.0-M1; from 10.0.0-M1, fixed in 10.3.0; from 11.0.0-M1, fixed in 11.0.0-M2.
Apache TomEE: Username enumeration and timing side channel in JAAS login modules
Affected: from 7.0.0-M1, fixed in 10.0.0-M1; from 10.0.0-M1, fixed in 10.3.0; from 11.0.0-M1, fixed in 11.0.0-M2.