Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

Threatpost

SecurityWeek

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Malware

Reddit Reverse Engineering

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

tomcat8

tomcat9

tomcat10

tomcat11

A security update for Tomcat 10 addresses multiple vulnerabilities including request smuggling, open redirect, TLS cipher order issues, OCSP check failures, bypass of EncryptInterceptor, incomplete escaping in JSON logs, exposure of Kubernetes bearer tokens, and an incomplete fix for a client certificate verification bypass. These issues affect various versions of Tomcat 10 distributed by SUSE and Ubuntu. The update upgrades Tomcat to version 10.1.54 and includes fixes for CVE-2025-66614 and several CVE-2026 series vulnerabilities. The severity of these vulnerabilities is rated high.

This security update for Tomcat 10 (version 10.1.54) fixes multiple vulnerabilities including CVE-2025-66614, a client certificate verification bypass due to virtual host mapping, and several CVE-2026 vulnerabilities such as request smuggling via invalid chunk extension (CVE-2026-24880), occasional open redirect (CVE-2026-25854), TLS cipher order preservation issues (CVE-2026-29129), OCSP check soft-failures even when disabled (CVE-2026-29145 and CVE-2026-34500), bypass of EncryptInterceptor (CVE-2026-29146 and CVE-2026-34486), incomplete escaping of JSON access logs (CVE-2026-34483), and exposure of Kubernetes bearer tokens in cloud membership for clustering (CVE-2026-34487). The update addresses an incomplete fix for CVE-2025-66614 (CVE-2026-32990). These vulnerabilities affect multiple SUSE and Ubuntu package versions of Tomcat 10. The vendor advisory from Red Hat confirms the availability of fixes and rates the security impact as moderate for their JBoss Web Server product, which includes Tomcat components.

Detailed information about UBUNTU-CVE-2025-66614 affecting null tomcat8. Get real-time updates, technical details, and mitigation strategies.

UBUNTU-CVE-2025-66614 - Live Threat Intelligence - Threat Radar | OffSeq.com

https://access.redhat.com/errata/RHSA-2026:12194

https://access.redhat.com/security/updates/classification/#moderate

https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/6.2/html/red_hat_jboss_web_server_6.2_service_pack_2_release_notes/index

2440430

2440437

2457025

Canonical URL

SUSE ratings

URL of this CSAF notice

SUSE Bug 1258371

SUSE Bug 1261850

SUSE Bug 1261851

SUSE Bug 1261852

SUSE Bug 1261853

SUSE Bug 1261854

SUSE Bug 1261855

SUSE Bug 1261856

SUSE Bug 1261857

SUSE CVE CVE-2025-66614 page

SUSE CVE CVE-2026-24880 page

SUSE CVE CVE-2026-25854 page

SUSE CVE CVE-2026-29129 page

SUSE CVE CVE-2026-29145 page

SUSE CVE CVE-2026-29146 page

SUSE CVE CVE-2026-32990 page

SUSE CVE CVE-2026-34483 page

SUSE CVE CVE-2026-34486 page

Security update for tomcat10

Threats Tagged 'bit-tomcat-2025-66614'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'bit-tomcat-2025-66614'

Lead Pen Test Professional