By weakness (CWE)

CWE-304: related vulnerabilities

CVEs classified under CWE-304. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

2 published vulnerabilities

• CVE-2026-55957HIGH 7.3

  Apache Tomcat contains an authentication bypass vulnerability when GSSAPI-based LDAP authentication is enabled through JNDIRealm. An attacker can log in without providing a valid password, gaining unauthorized access to the application. The flaw affects multiple Tomcat versions spanning nearly two decades of releases, from version 7 through 11.

• CVE-2026-57915HIGH 7.3

  Apache Kerby, an open-source implementation of the Kerberos protocol, contains a flaw in its pre-authentication validation logic. An attacker can craft a malicious authentication request containing a PA-DATA field with an unrecognized or unsupported type, allowing them to bypass the pre-authentication checks that normally prevent unauthorized access. This effectively weakens the initial security gate that protects against brute-force and replay attacks in Kerberos authentication flows.