Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2023-29014Mediumio.goobi.viewer:viewer-core: Goobi viewer Core Reflected Cross-Site Scripting Vulnerability Using LOGID ParameterCVE-2023-29015Mediumio.goobi.viewer:viewer-core: Goobi viewer Core has Cross-Site Scripting Vulnerability in User CommentsCVE-2023-29016Mediumio.goobi.viewer:viewer-core: Goobi viewer Core has Cross-Site Scripting Vulnerability in User NicknamesCVE-2023-25330Criticalcom.baomidou:mybatis-plus: MyBatis-Plus vulnerable to SQL injection via TenantPluginCVE-2020-20913Criticalnet.mingsoft:ms-mcms: Ming-Soft MCMS vulnerable to SQL injectionCVE-2023-26269Highorg.apache.james:javax-mail-extension: Apache James server's JMX management service vulnerable to privilege escalation by local userCVE-2023-28676Highorg.jenkins-ci.plugins:convert-to-pipeline: Jenkins Convert To Pipeline Plugin vulnerable to cross-site request forgeryCVE-2023-28670Highcom.paul8620.jenkins.plugins:pipeline-aggregator-view: Jenkins Pipeline Aggregator View Plugin vulnerable to Cross-site ScriptingCVE-2023-28671Mediumorg.jenkinsci.plugins:octoperf: Jenkins OctoPerf Load Testing Plugin vulnerable to Cross-site Request ForgeryCVE-2023-28674Mediumorg.jenkinsci.plugins:octoperf: Jenkins OctoPerf Load Testing Plugin vulnerable to Cross-site Request ForgeryCVE-2023-28672Mediumorg.jenkinsci.plugins:octoperf: Jenkins OctoPerf Load Testing Plugin vulnerable to credential captureCVE-2023-28675Mediumorg.jenkinsci.plugins:octoperf: Jenkins OctoPerf Load Testing Plugin missing permission check allows for unauthorized server connectionsCVE-2023-28673Mediumorg.jenkinsci.plugins:octoperf: Jenkins OctoPerf Load Testing Plugin missing permission check allows for ID enumeration CVE-2023-28681Highorg.jenkins-ci.plugins:vs-code-metrics: Jenkins Visual Studio Code Metrics Plugin vulnerable to XML external entity (XXE) attacksCVE-2023-28679Highjavagh.jenkins:mashup-portlets-plugin: Jenkins Mashup Portlets Plugin vulnerable to stored cross-site scriptingCVE-2023-28668Mediumorg.jenkins-ci.plugins:role-strategy: Jenkins Role-based Authorization Strategy Plugin grants permissions even after they’ve been disabledCVE-2023-28669Highorg.jenkins-ci.plugins:jacoco: Jenkins JaCoCo Plugin vulnerable to Stored Cross-site ScriptingCVE-2023-28677Highorg.jenkins-ci.plugins:convert-to-pipeline: Jenkins Convert To Pipeline Plugin vulnerable to command injectionCVE-2023-28680Highorg.jenkins-ci.plugins:crap4j: Jenkins Crap4J Plugin vulnerable to XML external entity (XXE) attacksCVE-2023-28678Highorg.jenkins-ci.plugins:cppcheck: Jenkins Cppcheck Plugin vulnerable to stored cross-site scripting (XSS)CVE-2023-28684Highcom.sap.jenkinsci:remote-jobs-view-plugin: Jenkins remote-jobs-view-plugin vulnerable to XML external entity attacksCVE-2023-28682Highorg.jenkins-ci.plugins:perfpublisher: Jenkins Performance Publisher Plugin vulnerable to XML external entity (XXE) attacksCVE-2023-28683Highorg.jenkins-ci.plugins:phabricator-plugin: Jenkins Phabricator Differential Plugin vulnerable to XML external entity (XXE) attacksCVE-2023-27025Highcom.ruoyi:ruoyi: RuoYi vulnerable to arbitrary file downloadGHSA-5X5Q-8CGM-2HJQHighcom.intuit.karate:karate-core: Karate has vulnerable dependency on json-smart package (CVE-2023-1370)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo