Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2023-29209Criticalorg.xwiki.platform:xwiki-platform-legacy-notification-activitymacro: org.xwiki.platform:xwiki-platform-legacy-notification-activitymacro Eval Injection vulnerabilityCVE-2023-29208Highorg.xwiki.platform:xwiki-platform-oldcore: org.xwiki.platform:xwiki-platform-oldcore vulnerable to data leak through deleted documents CVE-2023-30513Mediumorg.csanchez.jenkins.plugins:kubernetes: Jenkins Kubernetes Plugin does not properly mask credentialsCVE-2023-30514Mediumorg.jenkins-ci.plugins:azure-keyvault: Jenkins Azure Key Vault Plugin does not properly mask credentialsCVE-2023-30515Mediumio.jenkins.plugins:thycotic-devops-secrets-vault: Jenkins Thycotic DevOps Secrets Vault Plugin does not properly mask credentialsCVE-2023-30517Mediumio.jenkins.plugins:neuvector-vulnerability-scanner: Jenkins NeuVector Vulnerability Scanner Plugin disables SSL/TLS certificate and hostname validationCVE-2023-30518Mediumio.jenkins.plugins:thycotic-secret-server: Jenkins Thycotic Secret Server Plugin missing permissions checkCVE-2023-30519Mediumorg.jenkins-ci.plugins:quayio-trigger: Jenkins Quay.io trigger Plugin webhook endpoint can be accessed without authenticationCVE-2023-30516Mediumorg.jenkins-ci.plugins:image-tag-parameter: Jenkins Image Tag Parameter Plugin improperly introduces option to opt out of SSL/TLS certificate validationCVE-2023-30528Loworg.jenkins-ci.plugins:wso2id-oauth: Jenkins WSO2 Oauth Plugin does not mask the WSO2 Oauth client secret on the global configuration formCVE-2023-30529Mediumorg.jenkins-ci.plugins:lucene-search: Jenkins Lucene-Search Plugin vulnerable to Cross-Site Request ForgeryCVE-2023-30524Mediumorg.jenkins-ci.plugins:reportportal: Jenkins Report Portal Plugin configuration form does not mask tokensCVE-2023-30520Highorg.jenkins-ci.plugins:quayio-trigger: Jenkins Quay.io trigger Plugin Cross-site Scripting vulnerabilityCVE-2023-30521Mediumorg.jenkins-ci.plugins:assembla-merge-request-builder: Jenkins Assembla merge request builder Plugin missing authentication to access endpointCVE-2023-30522Mediumorg.jenkins-ci.plugins:fogbugz: Jenkins Fogbugz Plugin has missing permissions checkCVE-2023-30523Mediumorg.jenkins-ci.plugins:reportportal: Jenkins Report Portal Plugin allows users with Item/Extended Read permission to view tokens on Jenkins controllerCVE-2023-30525Mediumorg.jenkins-ci.plugins:reportportal: Jenkins Report Portal Plugin Cross-Site Request Forgery vulnerabilityCVE-2023-30526Mediumorg.jenkins-ci.plugins:reportportal: Jenkins Report Portal Plugin missing permissions checkCVE-2023-30527Loworg.jenkins-ci.plugins:wso2id-oauth: Jenkins WSO2 Oauth Plugin stores WSO2 Oauth client secret unencrypted in global config.xml file on Jenkins controllerCVE-2023-30530Mediumorg.jenkins-ci.plugins:consul-kv-builder: Jenkins Consul KV Builder Plugin stores HashiCorp Consul ACL Token unencryptedCVE-2023-30531Mediumorg.jenkins-ci.plugins:consul-kv-builder: Jenkins Consul KV Builder Plugin stores HashiCorp Consul ACL Token unencryptedCVE-2023-30532Mediumorg.jenkinsci.plugins.spoonscript:spoonscript: Lack of authentication mechanism in Jenkins TurboScript Plugin webhookCVE-2023-29215Criticalorg.apache.linkis:linkis-engineconn: Apache Linkis JDBC EngineConn has deserialization vulnerabilityCVE-2023-29216Criticalorg.apache.linkis:linkis-datasource: Apache Linkis DatasourceManager module has deserialization vulnerabilityCVE-2023-26120Mediumcom.xuxueli:xxl-job: XXL-JOB vulnerable to Cross-site Scripting

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo