https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-86247.htmlhttps://patchthecve.com/cve/CVE-2026-86247.htmlTue, 06 Oct 2026 13:46:49 +0000HIGH 7.4: Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affechttps://patchthecve.com/cve/CVE-2026-86246.htmlhttps://patchthecve.com/cve/CVE-2026-86246.htmlTue, 06 Oct 2026 13:50:57 +0000CRITICAL 9.1: Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX. This issue affects Apache Tomcat Native: from 2.0.0 throughhttps://patchthecve.com/cve/CVE-2026-86243.htmlhttps://patchthecve.com/cve/CVE-2026-86243.htmlTue, 06 Oct 2026 13:53:46 +0000HIGH 7.5: Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected. Users arehttps://patchthecve.com/cve/CVE-2026-29145.htmlhttps://patchthecve.com/cve/CVE-2026-29145.htmlMon, 26 Oct 2026 21:10:00 +0000CRITICAL 9.1: CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Nativ