CVE Watch15 de out. de 2026

CVE-2016-0763

The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and

CVSS

6.3

Média

EPSS

11.3%

p96

KEV

—

Exploit Today

0-100

Publicado: 25 de fev. de 2016 · Última mod.: 15 de out. de 2026 · CWE-264

EPSS · 30d

11.3%EPSS · 30 dias11.3%

2026-10-142026-11-11

Descrição técnica

The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1011845.5 MÉD

0.1%

——0Permission control vulnerability in the Bluetooth module. Impact: Successful exploitation of this vulnerability may affect availability.10d CVE-2026-1011773.7 BAI

3.9%

——1Permission control vulnerability in the Optimizer module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.10d CVE-2026-1011767.1 ALT

2.9%

——1Permission control vulnerability in the event notification management module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.10d CVE-2026-1011726.2 MÉD

0.5%

——0Permission control vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect confidentiality.10d CVE-2026-1011713.6 BAI

0.3%

——0Permission control vulnerability in the background task management module. Impact: Successful exploitation of this vulnerability may affect service integrity.10d CVE-2026-1163676.3 MÉD

22.3%

——7A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of the file packages/extensions/cordis-host-runner/src/sandbox.ts. The manipulation results in sandbox issue. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.10d