Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2017-1000425Mediumcom.liferay.portal:release.portal.bom: Liferay Portal XSS vulnerability via movie parameter in the /html/portal/flash.jsp pageCVE-2018-1000108Mediumorg.jenkins-ci.plugins:cppncss: Reflected cross-site-scripting vulnerability in report URL of Jenkins CppNCSS PluginCVE-2018-1000113Mediumorg.jenkins-ci.plugins:testlink: Stored cross-site scripting vulnerability in Jenkins TestLink PluginCVE-2013-1768Highorg.apache.openjpa:openjpa: Deserialization of Untrusted Data in Apache OpenJPACVE-2016-0793Highorg.wildfly:wildfly-parent: WildFly has incomplete blacklist vulnerabilityCVE-2016-6811Highorg.apache.hadoop:hadoop-common: Insecure Inherited Permissions in Apache HadoopCVE-2018-1000144Mediumorg.jenkins-ci.plugins:cucumber-living-documentation: Jenkins Cucumber Living Documentation Plugin Cross-site Scripting vulnerabilityCVE-2018-1000151Mediumorg.jenkins-ci.plugins:vsphere-cloud: Jenkins vSphere Plugin disables SSL/TLS certificate validation by defaultCVE-2018-1000147Mediumorg.jvnet.hudson.plugins:perforce: Jenkins Perforce Plugin exposure of sensitive information vulnerability existsCVE-2018-1000150Loworg.jenkins-ci.plugins:reverse-proxy-auth-plugin: Jenkins Reverse Proxy Auth Plugin allows attackers with local file system access to obtain a list of authorities for logged in usersCVE-2018-1000143Loworg.jenkins-ci.plugins:ghprb: Jenkins GitHub Pull Request Builder Plugin CVE-2018-1000142Mediumorg.jenkins-ci.plugins:ghprb: Jenkins GitHub Pull Request Builder Plugin allows attacker with local file system access to obtain GitHub credentialsCVE-2018-1000148Mediumorg.jenkins-ci.plugins:copy-to-slave: Jenkins Copy To Slave Plugin allows access to arbitrary files on the Jenkins controller file system CVE-2018-1000153Highorg.jenkins-ci.plugins:vsphere-cloud: Jenkins vSphere Plugin Cross-Site Request Forgery vulnerabilityCVE-2018-1000174Mediumorg.jenkins-ci.plugins:google-login: Jenkins Google Login Plugin Open Redirect vulnerabilityCVE-2018-1000173Mediumorg.jenkins-ci.plugins:google-login: Jenkins Google Login Plugin Session Fixation vulnerabilityCVE-2018-1000175Mediumorg.jenkins-ci.plugins:htmlpublisher: Jenkins HTML Publisher Plugin path traversal vulnerabilityCVE-2018-1000176Mediumorg.jenkins-ci.plugins:email-ext: Jenkins Email Extension Plugin showed plain text SMTP password in configuration form fieldCVE-2018-1000177Mediumorg.jenkins-ci.plugins:s3: Stored XSS vulnerability in Jenkins S3 Publisher PluginCVE-2018-1310Highorg.apache.nifi:nifi: Apache NiFi JMS Deserialization issueCVE-2018-1309Criticalorg.apache.nifi:nifi-standard-processors: Improper Restriction of XML External Entity Reference in Apache NiFiCVE-2018-11651Mediumorg.graylog2:graylog2-server: Cross-site Scripting in GraylogCVE-2018-11650Mediumorg.graylog2:graylog2-server: Cross-site Scripting in Graylog ServerCVE-2015-0899Highorg.apache.struts:struts-core: Improper Input Validation in Apache StrutsCVE-2015-5209Highorg.apache.struts:struts2-core: Special top object can be used to access Struts' internals

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo