Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-48717Mediumorg.openidentityplatform.openam:openam-oauth2: OpenAM OAuth Authorization Bypass via PKCE Challenge CVE-2026-47426Highorg.openidentityplatform.openam:openam-oauth2: OpenAM OAuth Client Impersonation via JWKS Resolver Cache CVE-2026-47424Highorg.openidentityplatform.openam:openam-scripting: OpenAM Authenticated RCE via Groovy Sandbox Escape CVE-2026-46623Highorg.openidentityplatform.openam:openam-auth-oauth2: OpenAM Account Takeover via Unverified Password Change in OAuth2 Module CVE-2026-46619Highorg.openidentityplatform.openam:openam-auth-msisdn: OpenAM Authentication Bypass via MSISDN LDAP Injection CVE-2026-53914Mediumorg.jetbrains.kotlin:kotlin-gradle-plugin: JetBrains Kotlin: Unsafe Deserialization in Kotlin Build Cache Enables Code Execution CVE-2025-55017Criticalorg.apache.iotdb:iotdb-server: Apache IoTDB has a Path Traversal vulnerability CVE-2025-64152Criticalorg.apache.iotdb:iotdb-server: Apache IoTDB has a Path Traversal vulnerability CVE-2026-57915Highorg.apache.kerby:kerb-server: Apache Kerby has a bypass the Kerberos pre-authentication check CVE-2026-57914Mediumorg.apache.kerby:kerby-asn1: Apache Kerby vulnerable to denial of service CVE-2026-12993Mediumio.apicurio:apicurio-registry-schema-util-xml: Apicurio Registry is vulnerable to denial of service through XML entity expansion CVE-2026-12992Highio.apicurio:apicurio-registry-schema-util-wsdl: Apicurio Registry allows upload of WSDL raising HTTP request CVE-2026-12975Highio.apicurio:apicurio-registry-schema-util-common: Apicurio Registry utilities allow SSRF and denial of service through XML parsing CVE-2026-48722Mediumio.nextflow:nextflow: nextflow auth login command has incorrect default permissions CVE-2026-46560Highorg.openidentityplatform.openam:openam-radius: OpenAM: Unauthenticated Authentication Bypass via RADIUS Spoofing CVE-2026-46498Highorg.openidentityplatform.openam:openam-oauth2: OpenAM Arbitrary OAuth Token Minting via Push Registration CVE-2026-45794Highorg.openidentityplatform.openam:openam-push-notification: OpenAM has Unsafe Java Deserialization via SNS CVE-2026-56130Loworg.apache.shiro:shiro-core: Apache Shiro's "remember me" cookie age is not verified on the server.CVE-2026-56091Highorg.apache.shiro:shiro-guice: Apache Shiro shiro-guice module vulnerable to authentication bypass CVE-2026-45052Criticalorg.openidentityplatform.openam:openam-federation-library: OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints CVE-2026-45051Criticalorg.openidentityplatform.openam:openam-auth-webauthn: OpenAM: Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage CVE-2026-57306Mediumio.jenkins.plugins:zdevops: Jenkins Zowe zDevOps Plugin has a CSRF vulnerability CVE-2026-57305Mediumorg.jenkins-ci.plugins:assembla: Jenkins Assembla Plugin has a cross-site request forgery (CSRF) vulnerability CVE-2026-12986Highfish.payara.distributions:payara: Payara Server Full has a Cross-Site Request Forgery vulnerability CVE-2026-57302Mediumorg.jenkins-ci.plugins:fitnesse: Jenkins FitNesse Plugin stores passwords unencrypted

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo