Apologies if this is a duplicate, but I don't see this message in the archive so I'm resending.
Hi, I was recently reviewing Tomcat vulnerabilities and I noticed that it appears that several CVEs for Tomcat going back to at least September of last year have not been published by Mitre. A few examples: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6797 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6816 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8745 Does anyone know why they haven't been published? And more importantly, does anyone know how to get these published? We use some tools to help us identify vulnerable versions based off of CVEs published in the NVD and not having them be published for so long is causing some problems. Regards, David
