Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2015-5298Mediumorg.jenkins-ci.plugins:google-login: Jenkins Google Login Plugin 1.0 and 1.1 allows anonymous users to authenticate through client-side request modificationCVE-2021-41042Mediumorg.eclipse.lyo:lyo-parent: XML External Entity Reference in Eclipse LyoCVE-2022-2048Highorg.eclipse.jetty.http2:http2-server: Jetty vulnerable to Invalid HTTP/2 requests that can lead to denial of serviceCVE-2022-2191Highorg.eclipse.jetty:jetty-server: Jetty SslConnection does not release pooled ByteBuffers in case of errorsCVE-2022-2047Loworg.eclipse.jetty:jetty-http: Jetty invalid URI parsing may produce invalid HttpURI.authorityCVE-2022-32533Criticalorg.apache.portals.jetspeed-2:jetspeed-commons: Insufficient user input in Apache Jetspeed-2CVE-2022-33980Criticalorg.apache.commons:commons-configuration2: Code injection in Apache Commons ConfigurationCVE-2021-43116Highcom.alibaba.nacos:nacos-client: Use of Hard-coded Credentials in NacosCVE-2022-31943Criticalnet.mingsoft:ms-mcms: Unrestricted Upload of File with Dangerous Type in MCMSCVE-2022-34811Mediumorg.jenkins-ci.plugins:xpath-config-viewer: Missing Authorization in Jenkins XPath Configuration Viewer PluginCVE-2022-34815Mediumorg.jenkins-ci.plugins:rrod: Cross-Site Request Forgery in Jenkins Request Rename Or Delete PluginCVE-2022-34806Loworg.jenkins-ci.plugins:jigomerge: Plaintext Storage of a Password in Jenkins Jigomerge PluginCVE-2022-34812Mediumorg.jenkins-ci.plugins:xpath-config-viewer: Cross-Site Request Forgery in Jenkins XPath Configuration Viewer PluginCVE-2022-34810Mediumnet.praqma:rqm-plugin: Jenkins RQM Plugin allows enumerating credentials IDs due to missing permission checkCVE-2022-34809Lownet.praqma:rqm-plugin: Password stored in plain text by Jenkins RQM PluginCVE-2022-34803Mediumorg.jenkins-ci.plugins:opsgenie: Jenkins OpsGenie Plugin Plaintext Storage of a Password vulnerabilityCVE-2022-34805Loworg.jenkins-ci.plugins:skype-notifier: Plaintext Storage of a Password in Jenkins Skype notifier PluginCVE-2022-34804Mediumorg.jenkins-ci.plugins:opsgenie: Jenkins OpsGenie Plugin vulnerable to Cleartext Transmission of Sensitive InformationCVE-2022-34817Mediumde.einsundeins.jenkins.plugins.failedjobdeactivator:failedJobDeactivator: Cross-Site Request Forgery in Jenkins Failed Job Deactivator PluginCVE-2022-34816Loworg.jenkins-ci.plugins:hpe-network-virtualization: Passwords stored in plain text by Jenkins hpe-network-virtualization pluginCVE-2022-34814Mediumorg.jenkins-ci.plugins:rrod: Incorrect Authorization in Jenkins Request Rename Or Delete PluginCVE-2022-34813Mediumorg.jenkins-ci.plugins:xpath-config-viewer: Jenkins XPath Configuration Viewer Plugin Missing Authorization vulnerabilityCVE-2022-34808Loworg.jenkins-ci.plugins:cisco-spark: Token stored in plain text by Jenkins Cisco Spark PluginCVE-2022-34818Mediumde.einsundeins.jenkins.plugins.failedjobdeactivator:failedJobDeactivator: Jenkins Failed Job Deactivator Plugin Missing Authorization vulnerabilityCVE-2022-34807Loworg.jenkins-ci.plugins:elasticsearch-query: Plaintext Storage of a Password in Jenkins Elasticsearch Query Plugin

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo