Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2019-16560Highorg.jenkins-ci.plugins:websphere-deployer: Cross-site request forgery vulnerability in Jenkins WebSphere Deployer PluginCVE-2019-16558Highcom.inflectra.spiratest.plugins:inflectra-spira-integration: Improper Certificate Validation in Jenkins Spira Importer PluginCVE-2019-16556Mediumorg.jenkins-ci.plugins:rundeck: Jenkins Rundeck Plugin stored credentials in plain text CVE-2019-16557Mediumcom.redgate.plugins.redgatesqlci:redgate-sql-ci: Jenkins Redgate SQL Change Automation Plugin has Insufficiently Protected CredentialsCVE-2019-16554Mediumcom.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer: Missing permission check in Jenkins Build Failure Analyzer PluginCVE-2019-16562Mediumorg.jenkins-ci.plugins:buildgraph-view: Jenkins buildgraph-view Plugin vulnerable to stored Cross-site ScriptingCVE-2019-16559Mediumorg.jenkins-ci.plugins:websphere-deployer: Jenkins WebSphere Deployer Plugin missing permission checkCVE-2019-16555Mediumcom.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer: Inefficient Regular Expression Complexity in Jenkins Build Failure Analyzer PluginCVE-2019-16549Highorg.jenkins-ci.plugins.m2release:m2release: Jenkins Maven Release Plug-in Plugin XXE vulnerabilityCVE-2019-16553Highcom.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer: Cross-Site Request Forgery in Jenkins Build Failure Analyzer PluginCVE-2019-16552Mediumcom.sonyericsson.hudson.plugins.gerrit:gerrit-trigger: Missing permission check in Jenkins Gerrit Trigger PluginCVE-2019-16551Highcom.sonyericsson.hudson.plugins.gerrit:gerrit-trigger: Cross-Site Request Forgery in Jenkins Gerrit Trigger PluginCVE-2019-16550Highorg.jenkins-ci.plugins.m2release:m2release: Cross-site request forgery (CSRF) vulnerability in Jenkins Maven Release PluginCVE-2019-14910Criticalorg.keycloak:keycloak-parent: Keycloak Authentication ErrorCVE-2019-14909Highorg.keycloak:keycloak-parent: Keycloak Authentication ErrorCVE-2019-10174Highorg.infinispan:infinispan-core: Use of Externally-Controlled Input to Select Classes or Code in InfinispanCVE-2019-16544Mediumorg.jenkins-ci.plugins:qmetry-for-jira-test-management: Jenkins QMetry for JIRA Plugin stored credentials in plain textCVE-2019-16548Mediumorg.jenkins-ci.plugins:google-compute-engine: Jenkins Google Compute Engine Plugin Cross-Site Request Forgery vulnerabilityCVE-2019-16546Mediumorg.jenkins-ci.plugins:google-compute-engine: Jenkins Google Compute Engine Plugin does not verify SSH host keys when connecting agents created by the pluginCVE-2019-16545Loworg.jenkins-ci.plugins:qmetry-for-jira-test-management: Jenkins QMetry for JIRA Plugin shows plain text password in configuration formCVE-2019-16543Lowcom.inflectra.spiratest.plugins:inflectra-spira-integration: Plaintext Storage in Jenkins Spira Importer PluginCVE-2019-16547Mediumorg.jenkins-ci.plugins:google-compute-engine: Jenkins Google Compute Engine Plugin Missing Authorization vulnerabilityCVE-2019-16540Highorg.jenkins-ci.plugins:support-core: Jenkins Support Core Plugin allowed users with Overall/Read permission to delete arbitrary filesCVE-2019-16542Mediumorg.jenkins-ci.plugins:anchore-container-scanner: Jenkins Anchore Container Scanner Plugin vulnerable to Insufficiently Protected CredentialsCVE-2019-16541Mediumorg.jenkins-ci.plugins:jira: Jenkins JIRA Plugin allows users to select and use credentials with System scope

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo