60
CVE-2026-34486: Apache Software Foundation Apache Tomcat
CISA added CVE-2026-34486, an actively exploited Apache Tomcat EncryptInterceptor bypass enabling unauthenticated deserialization RCE, to its KEV catalog.
CVE-2026-34486 allows bypass of Apache Tomcat's EncryptInterceptor, a flaw introduced by the fix for padding-oracle issue CVE-2026-29146 in Tribes cluster encryption. CISA added the flaw to the Known Exploited Vulnerability catalog on August 4, 2026, alongside actively exploited Langflow and N-central flaws, with remediation required under BOD 26-04 guidance. Official patches and workarounds are available, and reporting notes unauthenticated remote code execution through Java deserialization on the Tribes receiver port 4000.
72
60
60
60
60
60
60
CISA adds Log4Shell flaw to the Known Exploited Vulnerabilities Catalog
60
60
60
60
60
CISA's KEV Catalog Updated with 3 New Flaws Threatening IT Management Systems
60
60
60
60
⚡ Weekly Recap: Instagram Account Hacks, Android Zero
60
Threat Advisory: Critical Apache Log4j vulnerability being exploited in the wild
60