Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-48480Mediumio.netty.incubator:netty-incubator-codec-ohttp: OHttpVersionChunkDraft: Missing Final-Chunk Enforcement Leads to Undetected Stream TruncationCVE-2026-41862Highorg.springframework.statemachine:spring-statemachine-kryo: Spring Statemachine's Kryo-based persistence backends deserialize persisted state-machine contexts without enforcing a class allowlistCVE-2026-54517Mediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind has @JsonView bypass for setterless creator propertiesCVE-2026-54516Mediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fieldsCVE-2026-54515Mediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnorePropertiesCVE-2026-54514Mediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)CVE-2026-54513Highcom.fasterxml.jackson.core:jackson-databind: jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)CVE-2026-54512Highcom.fasterxml.jackson.core:jackson-databind: jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiationCVE-2026-50193Mediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()CVE-2026-54518Mediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind has a @JsonView bypass for unwrapped creator parametersCVE-2026-45049Highorg.openidentityplatform.openam:openam-federation: OpenAM Unauthenticated Session Hijacking via Information Exposure in CDCServletCVE-2026-45048Highorg.openidentityplatform.openam:openam-core: OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPCCVE-2026-12866Criticalexpr-eval: expr-eval vulnerable to Code ExecutionCVE-2026-46495Criticalorg.openidentityplatform.opendj:opendj-server-legacy: OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMICVE-2026-44795Highio.spinnaker.rosco:rosco-core: Spinnaker has non-safe yaml deserialization, allowing RCE when using specific typesCVE-2026-44793Loworg.openidentityplatform.openam:openam-federation-library: OpenAM SAML2 Cluster Cookie-Hash-Redirect Path has Pre-authentication Reflected XSS via `FSUtils.postToTarget`CVE-2026-44203Highorg.openidentityplatform.openam:openam-oauth2: OpenAM has pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)CVE-2026-44202Mediumorg.openidentityplatform.openam:openam-core: OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`CVE-2026-44179Criticalcom.xwiki.pro:xwiki-pro-macros: xwiki-pro-macros has remote code execution from page title and content via excerpt-include macroCVE-2026-41573Highorg.openidentityplatform.openam:openam-core-rest: OpenAM has LDAP Injection via `_queryId` ParameterCVE-2026-44913Mediumorg.apache.nifi:nifi-cdc-mysql-processors: Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQLCVE-2026-44914Highorg.apache.nifi:nifi-web-api: Apache NiFi: Missing authorization when replacing Process Groups with restricted componentsCVE-2026-44911Loworg.apache.nifi:nifi-web-api: Apache NiFi allows read-only users to submit component configuration verification requestCVE-2026-54665Mediumorg.apache.nifi:nifi-jetty: Apache NiFi fails to validate proxy host headers when constructing qualified URLsCVE-2025-62198Mediumorg.apache.atlas:atlas-dashboardv2: Apache Atlas UI: Authenticated User XSS

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo