Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-32967Criticalorg.apache.dolphinscheduler:dolphinscheduler-api: Apache DolphinScheduler: The `/v2` experimental interface lacks permission checksCVE-2026-32966Criticalorg.apache.dolphinscheduler:dolphinscheduler-api: Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure CVE-2026-47835Highorg.springframework.ai:spring-ai-opensearch-store: Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector StoresCVE-2026-41708Highorg.springframework.cloud:spring-cloud-sleuth-instrumentation: Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerabilityCVE-2026-39006Criticalorg.snmp4j:snmp4j-agent: SNMP4J-Agent allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath componentCVE-2026-50560Mediumio.netty:netty-codec-http2: Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signatureCVE-2026-50020Mediumio.netty:netty-codec-http: Netty: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permittedCVE-2026-50011Highio.netty:netty-codec-redis: Netty: Unbounded pre-allocation in RedisArrayAggregator from RESP array lengthCVE-2026-50010Highio.netty:netty-handler: Netty: Wrapping plain trust manager silently disables hostname verificationCVE-2026-50009Mediumio.netty:netty-codec-classes-quic: Netty: QUIC stateless reset token material exposed through header-visible connection IDsCVE-2026-48748Highio.netty:netty-codec-http3: Netty HTTP/3 QPACK Blocked Streams Memory ExhaustionCVE-2026-54697Mediumorg.connectbot.sshlib:sshlib: ConnectBot SSH Client Library: Excessive allocation and integer overflow in DER private-key parsingCVE-2026-54700Mediumorg.connectbot.sshlib:sshlib: ConnectBot SSH Client Library: Unbounded SSH field lengths can cause excessive memory allocationGHSA-J9GF-VW2F-9HRWHighcom.appsmith:server: Appsmith: Configuration-dependent origin validation bypass in password reset and email verification link generationGHSA-9WCP-79G5-5C3CHighcom.appsmith:server: Appsmith Super User Creation Race Condition Allows Multiple Instance AdministratorsCVE-2025-58175Mediumorg.geoserver.web:gs-web-app: GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity ResolutionCVE-2025-52465Highorg.geoserver.web:gs-web-app: GeoServer has an arbitrary file write vulnerability in its Master Password Dump PageCVE-2026-50645Highorg.apache.cxf:cxf-core: Apache cxf-core: No restriction on attachment headers per messageCVE-2026-50634Mediumorg.apache.cxf:cxf-rt-rs-security-jose-jaxrs: Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entryCVE-2026-50632Criticalorg.apache.cxf:cxf-rt-transports-jms: Apache CXF has JNDI Injection Vulnerability in JMSConfigFactoryCVE-2026-50633Criticalorg.apache.cxf:cxf-integration-jca: Apache CXF JNDI Injection vulnerability in DispatchMDBMessageListenerImplCVE-2026-50629Highorg.apache.cxf:cxf-rt-rs-security-oauth2: Apache CXF OAuth2 Log Injection via Unsanitized Client IdentifierCVE-2026-50628Criticalorg.apache.cxf:cxf-rt-rs-security-oauth2: Apache CXF OAuth2 has Inverted IP Binding Check that Defeats Security ControlCVE-2026-50631Highorg.apache.cxf:cxf-rt-rs-security-oauth2: Apache CXF OAuth2 TOCTOU Race Condition in Refresh Token ProcessingCVE-2026-50627Criticalorg.apache.cxf:cxf-rt-rs-security-oauth2: Apache CXF OAuth2 Missing JWT Audience and Issuer Validation in Access Token Validator

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo