Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-49485Highca.uhn.hapi.fhir:org.hl7.fhir.dstu2: org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP EndpointGHSA-Q6GH-6V2R-HJV3Mediumio.micronaut:micronaut-http-client: Micronaut: DefaultHttpClient follows redirects, forwarding Authorization, Cookie, and Proxy-Authorization headersGHSA-387M-935M-C4VWHighio.micronaut:micronaut-http-client: Micronaut doesn't set a maximum redirect count for its HTTP Client, enabling infinite loop DoSCVE-2026-49464Highnl.nl-portal:taak: NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taakCVE-2026-49463Mediumnl.nl-portal:documenten-api: NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-librariesCVE-2026-49833Mediumorg.dspace:dspace-api: DSpace: Path Traversal is possible through LDN message generationCVE-2026-49830Mediumorg.dspace:dspace-api: DSpace: ORE resource URI does not validate scheme for non-web resourcesCVE-2026-49831Mediumorg.dspace:dspace-api: DSpace has a possible Path Traversal Vulnerability in its Curation Task Reporter output pathCVE-2026-49832Highorg.dspace:dspace-api: DSpace has possible Remote Code Execution (RCE) through Velocity Templates used by LDNCVE-2026-34151Highorg.xwiki.platform:xwiki-platform-oldcore: XWiki Platform Old Core: Resource path traversal via /skin/ action endpoint in Jetty 12+GHSA-CGFV-JRFP-2R7VHighio.openremote:openremote-manager: OpenRemote has Authenticated SQL Injection via Datapoint Crosstab ExportCVE-2026-54640Highio.openremote:openremote-agent: OpenRemote has an incomplete fix for CVE-2026-40882: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected…CVE-2026-54641Highio.openremote:openremote-manager: OpenRemote has Cross-Realm User Information Disclosure in UserResourceImplCVE-2026-49439Mediumio.openremote:openremote-manager: OpenRemote read-only asset users can write predicted datapointsCVE-2026-49042Highorg.apache.camel:camel-langchain4j-tools: Apache Camel-Langchain4j-Tools: Tool argument headers are not filtered against declared parametersCVE-2026-46587Highorg.apache.camel:camel-couchbase: Apache Camel-Couchbase: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted inputCVE-2026-46588Highorg.apache.camel:camel-couchdb: Apache Camel-CouchDB: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted inputCVE-2026-56139Mediumorg.apache.camel:camel-undertow: Apache Camel-Undertow: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in…CVE-2026-53913Criticalorg.apache.camel:camel-keycloak: Apache Camel: KeycloakSecurityPolicy has Improper Authentication, Missing Authentication for Critical Function and Failing Open…CVE-2026-49097Mediumorg.apache.camel:camel-irc: Apache Camel-IRC: The irc.sendTo (and other irc.*) Exchange header constants used non-Camel-prefixed names that bypass the HTTP header…CVE-2026-49086Mediumorg.apache.camel:camel-dapr: Apache Camel-Dapr: The Dapr Pub/Sub consumer copied the inbound CloudEvent's pub/sub-name and topic into producer-direction routing headersCVE-2026-49098Mediumorg.apache.camel:camel-kafka: Apache Camel-Kafka: The kafka.OVERRIDE_TOPIC (and other kafka.*) Exchange header constants used non-Camel-prefixed names that bypass the…CVE-2026-48205Criticalorg.apache.camel:camel-dns: Apache Camel DNS Has Improper Input Validation, Leading to Server-Side Request Forgery (SSRF) CVE-2026-48206Mediumorg.apache.camel:camel-jira: Apache Camel-JIRA: A set of non-Camel-prefixed Exchange header constants bypass the HTTP header filterCVE-2026-49365Mediumorg.apache.camel:camel-netty-http: Apache Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in…

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo