CVE Watch15 jul 2026

CVE-2026-34486

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInte

CVSS

7.5

Alto

EPSS

21.7%

p97

KEV

—

Exploit Today

0-100

Publicado: 9 abr 2026 · Última mod.: 15 jul 2026 · CWE-311 · CWE-807

EPSS · 30d

15.8%EPSS · 30 días21.7%

2026-06-302026-07-16

Descripción técnica

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2022-262817.5 ALT

56.5%

——17BigAnt Server v5.6.06 was discovered to contain an incorrect access control issue.8d CVE-2026-241209.8 CRÍ

55.5%

——17vm2 is an open source vm/sandbox for Node.js. Prior to version 3.10.5, the fix for CVE-2023-37466 is insufficient and can be circumvented allowing attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.10.5.2d CVE-2021-406506.5 MED

50.0%

——15In Connx Version 6.2.0.1269 (20210623), a cookie can be issued by the application and not have the secure flag set.8d CVE-2023-318257.5 ALT

47.0%

——14An issue found in Inageya v.13.4.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp Inageya function.8d CVE-2023-318227.5 ALT

47.0%

——14An issue found in Entetsu Store v.13.4.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp Entetsu Store function.8d CVE-2023-318207.5 ALT

47.0%

——14An issue found in Shizutetsu Store v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp function.8d