Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-43646Highorg.apache.wicket:wicket-parent: Apache Wicket has an Exposure of Sensitive Information to an Unauthorized Actor vulnerability CVE-2026-43975Mediumorg.apache.wicket:wicket-core: Apache Wicket has a Path Traversal issue CVE-2026-42509Mediumorg.apache.wicket:wicket-parent: Apache Wicket has a Cross-site Scripting issue CVE-2026-40010Criticalorg.apache.wicket:wicket-auth-roles: Apache Wicket has a Session Fixation issue CVE-2026-44221Criticalcom.arcadedb:arcadedb-server: ArcadeDB vulnerable to cross-database authorization bypass and unsecured newly-created databases GHSA-MGGX-P7JF-JGW4Highorg.jdbi:jdbi3-freemarker: jdbi3-freemarker Vulnerable to Improper Neutralization of Special Elements Used in FreeMarker Template Engine CVE-2026-42198Highorg.postgresql:postgresql: pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS CVE-2026-42188Loworg.geysermc.geyser:core: Geyser Vulnerable to Server-Side Request Forgery (SSRF) via Player Head Texture URL in Geyser CVE-2026-42140Mediumorg.xwiki.contrib.plantuml:macro-plantuml-macro: XWiki PlantUML Macro Vulnerable to Server-Side Request Forgery (SSRF) via 'server' parameter CVE-2026-7411Criticalorg.eclipse.basyx:basyx.sdk: Eclipse BaSyx Java Server SDK vulnerable to Path Traversal CVE-2026-7412Highorg.eclipse.basyx:basyx.sdk: Eclipse BaSyx Java Server SDK vulnerable to Server-Side Request Forgery CVE-2026-41417Mediumio.netty:netty-codec-http: Netty: Start-Line Injection in DefaultHttpRequest.setUri() Allows HTTP Request Smuggling and RTSP Request Injection CVE-2026-43869Highorg.apache.thrift:libthrift: Apache Thrift has an Improper Validation of Certificate with Host Mismatch Vulnerability CVE-2026-42333Mediumio.quarkiverse.openapi.generator:quarkus-openapi-generator: quarkus-openapi-generator has overly broad path-parameter matching that sends authentication headers to unintended operations CVE-2026-41901Criticalorg.thymeleaf:thymeleaf: Sandboxed Thymeleaf expressions vulnerable to improper recognition of unauthorized syntax patterns CVE-2026-41258Criticalorg.openmrs.api:openmrs-api: OpenMRS has Stored Velocity SSTI to RCE via ConceptReferenceRange CVE-2026-42812Criticalorg.apache.polaris:polaris-runtime-service: Apache Polaris has an Improper Input Validation issue CVE-2026-42440Highorg.apache.opennlp:opennlp-tools: Apache OpenNLP AbstractModelReader has an OOM Denial of Service via Unbounded Array Allocation CVE-2026-42811Criticalorg.apache.polaris:polaris-core: Apache Polaris has an Improper Input Validation issue CVE-2026-42810Criticalorg.apache.polaris:polaris-core: Apache Polaris has an Improper Input Validation Issue CVE-2026-42027Criticalorg.apache.opennlp:opennlp-tools: Apache OpenNLP ExtensionLoader Vulnerable to Arbitrary Class Instantiation via Model Manifest CVE-2026-42809Criticalorg.apache.polaris:polaris-runtime-service: Apache Polaris has an Improper Input Validation Issue CVE-2026-40682Criticalorg.apache.opennlp:opennlp-tools: Apache OpenNLP DictionaryEntryPersistor Vulnerable to XML External Entity (XXE) via Unsanitized Dictionary Parsing CVE-2026-40563Highorg.apache.atlas:apache-atlas: Apache Atlas has a Code Injection Vulnerability CVE-2026-40076Criticalorg.openmrs.web:openmrs-web: OpenMRS Module Upload Vulnerable to Path Traversal (Zip Slip)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.