Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-53712Highcom.ongres.scram:scram-client: OnGres SCRAM silent channel-binding authentication downgrade via unsupported certificate algorithms CVE-2026-9795Highorg.keycloak:keycloak-services: Keycloak has privilege escalation via improper scope mapping enforcement GHSA-J6HM-V3X2-QV6JLowland.oras:oras-java-sdk: land.oras:oras-java-sdk: Symlink-based path traversal in ArchiveUtils.untar / unzip allows arbitrary file write outside extraction directory CVE-2026-49989Lowio.crate:crate: CrateDB's Blob HTTP handler bypasses authorization CVE-2026-54428Highorg.apache.httpcomponents.core5:httpcore5-h2: Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK CVE-2026-54399Highorg.apache.httpcomponents.core5:httpcore5: Apache HttpComponents Core HTTP/1 header parsing can cause memory-exhaustion denial of service CVE-2026-46487Highorg.geonetwork-opensource:geonetwork: GeoNetwork has ACL bypass on Elasticsearch search when request body omits query field CVE-2026-39379Highorg.geonetwork-opensource:geonetwork: GeoNetwork has reflected XSS through client-side template injection CVE-2026-48791Lowdev.sigstore:sigstore-java: Sigstore Java has a vulnerability with bundle verification of integratedTime CVE-2025-53648Mediumorg.apache.gravitino:catalog-jdbc-common: Apache Gravitino JDBC configuration validation bypass can allow file reads or truncation CVE-2026-49432Highorg.apache.activemq:apache-activemq: Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp has an Improper Input Validation vulnerability CVE-2026-54475Highorg.apache.activemq:activemq-broker: Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Missing Authorization vulnerability CVE-2026-53917Highorg.apache.activemq:apache-activemq: Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker have Memory Allocation with Excessive Size Value…CVE-2026-50750Highorg.apache.activemq:activemq-broker: Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have a Denial of Service via Out of Memory vulnerability CVE-2026-52760Mediumorg.apache.activemq:apache-activemq: Apache ActiveMQ, Apache ActiveMQ Web Console vulnerable to Cross-site Scripting CVE-2026-50734Highorg.apache.activemq:activemq-client: Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All has a Memory Allocation with Excessive Size Value vulnerability CVE-2026-49434Highorg.apache.activemq:activemq-broker: Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have an Improper Input Validation vulnerability CVE-2026-49877Highorg.apache.activemq:apache-activemq: Apache ActiveMQ Improper Authorization vulnerability CVE-2026-55957Highorg.apache.tomcat.embed:tomcat-embed-core: Apache Tomcat has a Missing Critical Step in Authentication vulnerability CVE-2026-55276Criticalorg.apache.tomcat.embed:tomcat-embed-core: Apache Tomcat has an Always-Incorrect Control Flow Implementation vulnerability CVE-2026-55956Mediumorg.apache.tomcat.embed:tomcat-embed-core: Apache Tomcat has an Improper Authorization vulnerability CVE-2026-55955Mediumorg.apache.tomcat:tomcat: Apache Tomcat has an Improper Authentication vulnerability CVE-2026-53434Criticalorg.apache.tomcat:tomcat-util: Apache Tomcat util accepted misconfigured CRLs CVE-2026-50229Mediumorg.apache.tomcat:tomcat: Apache Tomcat has a Cross-site Scripting vulnerability CVE-2026-53404Highorg.apache.tomcat.embed:tomcat-embed-core: Apache Tomcat's rewrite valve has an Always-Incorrect Control Flow Implementation vulnerability

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo