Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2023-24455Mediumio.jenkins.plugins:visualexpert: Path Traversal in Jenkins visualexpert PluginCVE-2023-24452Highorg.jenkins-ci.plugins:testquality-updater: CSRF vulnerability in Jenkins TestQuality Updater Plugin CVE-2023-24456Criticalorg.jenkins-ci.plugins:keycloak: Session fixation vulnerability in Jenkins Keycloak Authentication PluginCVE-2023-24459Mediumorg.jenkins-ci.plugins:bearychat: Missing permission check in Jenkins BearyChat PluginCVE-2023-24458Highorg.jenkins-ci.plugins:bearychat: Cross-site request forgery vulnerability in Jenkins BearyChat PluginCVE-2023-24457Mediumorg.jenkins-ci.plugins:keycloak: CSRF vulnerability in Jenkins Keycloak Authentication Plugin CVE-2023-23613Mediumorg.opensearch.plugin:opensearch-security: Field-level security issue with .keyword fields in OpenSearchCVE-2023-23612Mediumorg.opensearch.plugin:opensearch-security: Issue with whitespace in JWT roles in OpenSearchCVE-2023-24057Criticalca.uhn.hapi.fhir:org.hl7.fhir.core: MITM based Zip Slip in `ca.uhn.hapi.fhir:org.hl7.fhir.core`GHSA-XR8X-PXM6-PRJGCriticalorg.hl7.fhir.publisher:org.hl7.fhir.publisher: MITM based Zip Slip in `org.hl7.fhir.publisher:org.hl7.fhir.publisher`CVE-2022-47105Criticalorg.jeecgframework.boot:jeecg-boot-base-core: Jeecg-boot is vulnerable to SQL injection CVE-2022-25901Mediumcookiejar: cookiejar Regular Expression Denial of Service via Cookie.parse functionCVE-2010-10006Highorg.expressme:JOpenId: Observable timing discrepancy in JOpenIdCVE-2023-22602Highorg.apache.shiro:shiro-root: Apache Shiro Interpretation Conflict vulnerabilityCVE-2022-23532Highorg.neo4j.procedure:apoc: org.neo4j.procedure:apoc Path Traversal VulnerabilityCVE-2022-3143Highorg.wildfly.security:wildfly-elytron: Wildfly-elytron possibly vulnerable to timing attacks via use of unsafe comparatorCVE-2023-0091Mediumorg.keycloak:keycloak-core: Keycloak has lack of validation of access token on client registrations endpointCVE-2022-24913Mediumcom.fasterxml.util:java-merge-sort: Java Merge-sort Insecure Temporary File vulnerabilityCVE-2023-22899Mediumnet.lingala.zip4j:zip4j: Zip4j Origin Validation ErrorGHSA-Q95J-488Q-5Q3PMediumio.apiman:apiman-manager-api-impl: Apiman Manager API affected by Jackson denial of service vulnerabilityCVE-2022-46769Mediumorg.apache.sling:org.apache.sling.cms: Apache Sling App CMS vulnerable to reflected Cross-site ScriptingCVE-2018-25068Criticalcom.anrisoftware.globalpom:globalpomutils: globalpom-utils has Insecure Temporary FileCVE-2023-22465Highorg.http4s:http4s-core_2.13: Http4s improperly parses User-Agent and Server headersCVE-2023-22457Criticalorg.xwiki.contrib:application-ckeditor-ui: XWiki CKEditor.HTMLConverter vulnerable to Remote Code Execution via Cross-Site Request ForgeryCVE-2022-45935Mediumorg.apache.james:james-server: Apache James server allows an attacker with local access to access private user data in transit

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo