Security Configuration Guides:

• CIS Benchmarks 
• STIG – not available
• SCAP NIST – not available
• Apache Tomcat 7 – Security Considerations
• Apache Tomcat 8 – Security Considerations
• Apache Tomcat 9 – Security Considerations

Vulnerabilities:

• Apache Tomcat Security Updates
• CVE Details
• Vulners

Exploits:

• Available Exploits: Exploit-DB