Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-56120Criticalio.openremote:openremote-manager: OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)GHSA-C7JM-38GQ-H67HMediumorg.http4k:http4k-security-digest: http4k: `ServerFilters.DigestAuth` / `DigestAuthProvider` defaulted to an always-true nonce verifier, disabling replay protection in…GHSA-PR33-38XX-6R26Mediumorg.http4k:http4k-core: http4k: BasicCookieStorage` (renamed `InsecureCookieStorage`) did not enforce RFC 6265 cookie scoping; new `DefaultCookieStorage` is now…GHSA-M4W9-HJFW-VWJ4Highorg.http4k:http4k-core: http4k: `HmacSha256.hash` (despite the `Hmac` naming) computed a plain unkeyed digest; clarified by deprecation in favour of `Sha256.hash`…GHSA-JRPC-7VXP-69P6Mediumorg.http4k:http4k-core: http4k: `reverseProxy()` defaulted to substring (`Contains`) matching on `Host`; tightened to `Exact`CVE-2026-55847Mediumio.qameta.allure:allure-generator: Allure Report: Stored XSS via unescaped ANSI helper in status message/trace renderingCVE-2026-55846Mediumio.qameta.allure:allure-commandline: Allure Report: Path Traversal in HTTP Server Allows Arbitrary File ReadCVE-2026-55773Highcom.cedarpolicy:cedar-java: CedarJava has policy injection vulnerabilityCVE-2026-55772Highcom.cedarpolicy:cedar-java: CedarJava has type confusion vulnerability CVE-2026-55414Mediumnl.nl-portal:form: NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)CVE-2026-11752Mediumcom.linecorp.armeria:armeria-xds: Armeria: External Control of File Name or Path in xDS SDS DataSourceCVE-2026-54683Mediumnl.nl-portal:documenten-api: NL Portal Backend Libraries: Document contents remained downloadable by any logged-in user (incomplete fix of CVE-2026-49463)CVE-2026-56740Highorg.jline:jline-remote-telnet: JLine3 Telnet server: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet NEW-ENVIRON VariablesCVE-2026-56741Highorg.jline:jline-remote-telnet: JLine3 Telnet server: Unauthenticated Remote DoS via Unbounded Telnet NAWS Terminal GeometryGHSA-2C85-RFCC-G74JHighio.karatelabs:karate-core: Karate Mock Server RCE via embedded expression evaluation of request-derived dataCVE-2026-55226Mediumio.strimzi:strimzi: Strimzi: Unrestricted access to all Secrets within namespace watched by the Topic operatorCVE-2026-55225Highio.strimzi:strimzi: Strimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`CVE-2026-55471Criticalca.uhn.hapi.fhir:org.hl7.fhir.utilities: HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactoryCVE-2026-55470Highca.uhn.hapi.fhir:org.hl7.fhir.dstu2: HAPI FHIR: Incomplete fix for CVE-2026-45367: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoSCVE-2026-55760Highcom.github.jknack:handlebars: handlebars.java FileTemplateLoader Path TraversalCVE-2026-55405Highdev.langchain4j:langchain4j-mariadb: LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvectorCVE-2026-49268Highorg.apache.shiro:shiro-core: Apache Shiro: LDAP DN Injection in DefaultLdapRealmCVE-2026-47340Mediumorg.apache.dolphinscheduler:dolphinscheduler-api: Apache DolphinScheduler: An incorrect authorization vulnerability allows authenticated users to access alert instances associated with…CVE-2026-42357Mediumorg.apache.dolphinscheduler:dolphinscheduler-api: Apache DolphinScheduler: Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects…CVE-2026-41280Mediumorg.apache.dolphinscheduler:dolphinscheduler-api: Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in…

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo