# Apache TomEE: 38 CVEs addressed in 10.3.0 and 11.0.0-M2 (combined announcement)

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/681) · 2026-11-12 · Security
Page: https://themorning.dev/story/apache-tomee-38-cves-addressed-in-10-3-0-and-11-0-0-m2-combined-announcement-5cbe85a41864a8e7
Kind: security · Impact: high

## In brief

- On 10 November 2026, the Apache TomEE project published 38 security advisories.
- Apache TomEE 10.3.0 and 11.0.0-M2 fix 26 of the vulnerabilities.
- The available source excerpt does not describe the remaining 12.

## Why it matters

Developers running Apache TomEE should check which of the 38 advisories affect their deployed version and move to a fixed release.

## What to do

- Upgrade Apache TomEE to 10.3.0 or 11.0.0-M2, or a later fixed release, and review the individual advisories for the remaining vulnerabilities.

## Versions

- Apache TomEE 10.3.0
- Apache TomEE 11.0.0-M2

## Timeline

- 2026-11-10: Apache TomEE project published 38 security advisories

## Coverage

- [Apache TomEE: 38 CVEs addressed in 10.3.0 and 11.0.0-M2 (combined announcement)](https://seclists.org/oss-sec/2026/q4/681) — Open Source Security, 2026-11-12

Tags: apache tomee, security, cve, java, jakarta ee

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev