Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-11800Highorg.keycloak:keycloak-services: Keycloak has authentication bypass via jwt algorithm confusionCVE-2026-119276Mediumorg.mariadb.jdbc:mariadb-java-client: MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packetsCVE-2026-119279Mediumorg.mariadb.jdbc:mariadb-java-client: MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengthsCVE-2026-119280Loworg.mariadb.jdbc:mariadb-java-client: MariaDB Connector/J: XA recover() trusted server-supplied gtrid and bqual lengthsCVE-2026-119210Mediumorg.mariadb.jdbc:mariadb-java-client: MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server…CVE-2026-119281Mediumorg.mariadb.jdbc:mariadb-java-client: MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticingCVE-2026-54442Mediumgov.nsa.emissary:emissary: NationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571CVE-2026-9086Highorg.keycloak:keycloak-services: Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypassCVE-2026-9083Mediumorg.keycloak:keycloak-services: Keycloak vulnerable to information disclosure through arbitrary filesystem path probingCVE-2026-9799Mediumorg.keycloak:keycloak-services: Keycloak allows unauthorized access to resources via uma permission ticket bypassCVE-2026-9800Highorg.keycloak:keycloak-services: Keycloak vulnerable to authorization bypass via incorrect uri comparisonCVE-2026-9705Mediumorg.keycloak:keycloak-services: Keycloak: Attacker can re-enable and take over disabled clients via registration access tokenCVE-2026-118259Mediumio.opentelemetry:opentelemetry-api: opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsingCVE-2026-93451Highorg.xerial.snappy:snappy-java: snappy-java: Heap buffer overflow in Snappy.uncompress*Array typed-array methodsCVE-2026-116590Mediumorg.xerial.snappy:snappy-java: snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWriteCVE-2026-108106Highorg.xerial.snappy:snappy-java: snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengthaCVE-2026-102554Highcom.google.guava:guava: Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocationCVE-2026-113730Mediumognl:ognl: OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxiesCVE-2026-111762Mediumorg.a2aproject.sdk:a2a-java-sdk-transport-rest: A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failureCVE-2026-111765Highorg.a2aproject.sdk:a2a-java-sdk-http-client-android: A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fixCVE-2026-111761Mediumorg.a2aproject.sdk:a2a-java-sdk-server-common: A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification deliveryCVE-2026-111764Highorg.a2aproject.sdk:a2a-java-sdk-server-common: A2A Java SDK has a fail-open default task authorizationCVE-2026-111763Mediumorg.a2aproject.sdk:a2a-java-sdk-parent: A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirectCVE-2026-102834Highorg.bytedeco:javacv: JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoSCVE-2026-97370Highcom.github.junrar:junrar: Junrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extraction

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo