Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2017-5636Criticalorg.apache.nifi:nifi: Injection in Apache NiFi CVE-2017-12628Highorg.apache.james:james-project: Apache James Privilege Escalation CVE-2015-2575Mediummysql:mysql-connector-java: Improper Access Control in MySQL Connectors Java CVE-2014-0095Mediumorg.apache.tomcat:tomcat-coyote: Denial of service in Apache Tomcat CVE-2014-0115Highorg.apache.storm:storm: Apache Storm log viewer path traversal vulnerability CVE-2017-15911Mediumorg.igniterealtime.openfire:parent: Ignite Realtime Openfire Server has Cross-site Scripting vulnerability in admin console CVE-2012-4449Criticalorg.apache.hadoop:hadoop-client: Use of a Broken or Risky Cryptographic Algorithm in Apache Hadoop CVE-2017-1000242Loworg.jenkins-ci.plugins:git-client: Insecure temporary file usage in Jenkins Git Client Plugin CVE-2017-1000209Mediumcom.neovisionaries:nv-websocket-client: nv-websocket-client allows attackers to spoof SSL/TLS servers via an arbitrary valid certificate CVE-2017-8045Criticalorg.springframework.amqp:spring-amqp: Deserialization of Untrusted Data in Spring AMQP CVE-2016-4993Mediumorg.wildfly:wildfly-undertow: Improper Neutralization of CRLF Sequences in Wildfly Undertow CVE-2016-7046Mediumio.undertow:undertow-core: Undertow Uncaught Exception vulnerability CVE-2014-0086Mediumorg.richfaces:richfaces: JBoss RichFaces Improper Input Validation vulnerability CVE-2017-1000406Highorg.opendaylight.integration:distribution-karaf: Password change doesn't result in Karaf clearing cache CVE-2022-30126Mediumorg.apache.tika:tika-core: Regular expression denial of service in apache tika CVE-2022-25169Mediumorg.apache.tika:tika: Apache Tika vulnerable to uncontrolled memory consumption CVE-2021-23267Highorg.craftercms:crafter-studio: Crafter CMS Crafter Studio vulnerable to Improper Control of Dynamically-Managed Code Resources CVE-2021-23265Mediumorg.craftercms:craftercms: Improper Privilege Management in craftercms CVE-2021-23266Mediumorg.craftercms:craftercms: Log value insertion in craftercms CVE-2017-17383Mediumorg.jenkins-ci.main:jenkins-core: Cross-site Scripting in Jenkins Core CVE-2014-3604Mediumca.juliusdavies:not-yet-commons-ssl: Improper Validation of Certificate with Host Mismatch in Not Yet Commons SSL CVE-2014-3530Highorg.picketlink:picketlink-common: XML External Entity Reference in org.picketlink:picketlink-common CVE-2016-0789Mediumorg.jenkins-ci.main:jenkins-core: Jenkins has CRLF Injection Vulnerability in the CLI CVE-2016-0788Criticalorg.jenkins-ci.main:jenkins-core: Jenkins allows Execution of Code by Opening a JRMP Listener CVE-2016-0790Mediumorg.jenkins-ci.main:jenkins-core: Exposure of Sensitive Information in Jenkins Core

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.