Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2019-16530Highorg.sonatype.nexus:nexus-repository: Unrestricted Upload of File with Dangerous Type in Sonatype Nexus Repository ManagerCVE-2019-13116Criticalorg.mule.runtime:mule: Mulesoft Mule Unsafe DeserializationCVE-2019-10458Criticalorg.jenkins-ci.plugins.workflow:puppet-enterprise-pipeline: Incorrect Authorization in Puppet Enterprise Pipeline Jenkins PluginCVE-2019-10457Mediumorg.jenkins-ci.plugins:oracle-cloud-infrastructure-compute-classic: Missing permission check in Jenkins Oracle Cloud Infrastructure Compute Classic Plugin CVE-2019-10450Lowcom.elasticbox.jenkins-ci.plugins:elasticbox: Cleartext Storage of Sensitive Information in Jenkins ElasticBox CI PluginCVE-2019-10455Mediumorg.jenkins-ci.plugins:rundeck: Missing permission check in Jenkins Rundeck PluginCVE-2019-10454Mediumorg.jenkins-ci.plugins:rundeck: Jenkins Rundeck Plugin CSRF vulnerabilityCVE-2019-10453Highorg.jenkins-ci.plugins:delphix: Jenkins Delphix Plugin vulnerable to Cleartext credential storageCVE-2019-10449Mediumorg.jenkins-ci.plugins:fortify-on-demand-uploader: Jenkins Fortify on Demand Plugin stores credentials in plain textCVE-2019-10452Mediumorg.jenkins-ci.plugins:view26: Jenkins View26 Test-Reporting Plugin stores access token in plain textCVE-2019-10451Mediumcom.soasta.jenkins:cloudtest: Jenkins SOASTA CloudTest Plugin stores API token in plain textCVE-2019-10456Mediumorg.jenkins-ci.plugins:oracle-cloud-infrastructure-compute-classic: Jenkins Oracle Cloud Infrastructure Compute Classic Plugin cross-site request forgery vulnerabilityCVE-2019-10436Mediumorg.jenkins-ci.plugins:google-oauth-plugin: Improper Limitation of a Pathname to a Restricted Directory in Jenkins Google OAuth Credentials PluginCVE-2019-10441Mediumorg.jenkins-ci.plugins:icescrum: Jenkins iceScrum Plugin vulnerable to Cross-site Request ForgeryCVE-2019-10439Mediumorg.jenkins-ci.plugins:crx-content-package-deployer: Jenkins CRX Content Package Deployer Plugin subject to credentials enumeration via Missing AuthorizationCVE-2019-10448Highjenkins.xtc:extensivetesting: Cleartext Storage of Sensitive Information in Jenkins Extensive Testing PluginCVE-2019-10443Highorg.jenkins-ci.plugins:icescrum: Jenkins iceScrum Plugin stores credentials in CleartextCVE-2019-10447Mediumio.jenkins.plugins:sofy-ai: Jenkins Sofy.AI Plugin stores API token in plain text CVE-2019-10446Highorg.jenkins-ci.plugins:vmanager-plugin: Jenkins Cadence vManager Plugin disables SSL/TLS and hostname verification CVE-2019-10444Mediumorg.jenkins-ci.plugins:bumblebee: Jenkins Bumblebee HP ALM Plugin unconditionally disabled SSL/TLS certificate validationCVE-2019-10445Mediumorg.jenkins-ci.plugins:google-kubernetes-engine: Missing permission checks in Google Kubernetes Engine Jenkins PluginCVE-2019-10442Mediumorg.jenkins-ci.plugins:icescrum: Jenkins iceScrum Plugin vulnerable to Missing AuthorizationCVE-2019-10440Highorg.jenkins-ci.plugins:neoload-jenkins-plugin: Jenkins NeoLoad Plugin stores credentials in cleartextCVE-2019-10438Mediumorg.jenkins-ci.plugins:crx-content-package-deployer: Jenkins CRX Content Package Deployer Plugin subject to Missing AuthorizationCVE-2019-10437Highorg.jenkins-ci.plugins:crx-content-package-deployer: Jenkins CRX Content Package Deployer Plugin subject to Cross-Site Request Forgery

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo