Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2014-7809Mediumorg.apache.struts:struts2-core: Cross-Site Request Forgery in Apache Struts CVE-2015-0225Highorg.apache.cassandra:apache-cassandra: Improper Neutralization of Special Elements used in a Command in Apache Cassandra CVE-2015-1427Highorg.elasticsearch:elasticsearch: Improper Access Control in Elasticsearch CVE-2015-1833Mediumorg.apache.jackrabbit:jackrabbit-core: Improper Input Validation in Apache Jackrabbit CVE-2015-2351Loworg.opencms:opencms-core: Alkacon OpenCMS XSS via homelink, workplaceresource, mode and query parameters CVE-2015-3188Criticalorg.apache.storm:storm: Apache Storm remote code execution vulnerability CVE-2015-4165Highorg.elasticsearch:elasticsearch: Improper Access Control in Elasticsearch CVE-2015-5531Mediumorg.elasticsearch:elasticsearch: Improper Limitation of a Pathname to a Restricted Directory in Elasticsearch CVE-2015-7611Highorg.apache.james:james-server: Apache James Server OS Command Injection CVE-2016-0784Mediumorg.apache.openmeetings:openmeetings-install: Apache OpenMeetings Directory Traversal vulnerability CVE-2016-0956Highorg.apache.sling:org.apache.sling.servlets.post: Exposure of Sensitive Information to an Unauthorized Actor in Apache Sling Servlets Post CVE-2016-2163Mediumorg.apache.openmeetings:openmeetings-parent: Apache OpenMeetings Cross-site Scripting vulnerability CVE-2016-2164Highorg.apache.openmeetings:openmeetings-parent: Apache OpenMeetings allows remote attackers to read arbitrary files by attempting to upload a file CVE-2016-3089Mediumorg.apache.openmeetings:openmeetings-parent: Apache OpenMeetings Cross-site Scripting vulnerability CVE-2016-4314Mediumorg.wso2.carbon.commons:org.wso2.carbon.logging.view.ui: WSO2 Carbon directory traversal vulnerability CVE-2016-4316Mediumorg.wso2.carbon.commons:org.wso2.carbon.ndatasource.ui: WSO2 Carbon vulnerable to Cross-site Scripting CVE-2016-4437Criticalorg.apache.shiro:shiro-core: Improper Access Control in Apache Shiro CVE-2016-4974Highorg.apache.qpid:qpid-jms-client: Improper Input Validation in Apache Qpid AMQP 0-x JMS CVE-2016-6802Highorg.apache.shiro:shiro-all: Improper Access Control in Apache Shiro CVE-2017-9802Mediumorg.apache.sling:org.apache.sling.servlets.post: Improper Neutralization of Input During Web Page Generation Apache Sling Servlets Post CVE-2018-1999037Loworg.jenkins-ci.plugins:resource-disposer: Jenkins Resource Disposer Plugin allows attacker to stop tracking specified resource CVE-2010-1587Mediumorg.apache.activemq:activemq-web-console: Apache ActiveMQ Sensitive Information Disclosure via the Jetty ResourceHandler CVE-2010-2103Mediumorg.apache.axis2.wso2:axis2: Improper Neutralization of Input During Web Page Generation in Apache Axis2 CVE-2010-3700Mediumorg.springframework.security:spring-security-core: Authentication Bypass Using an Alternate Path or Channel in SpringSource Spring Security and Acegi Security CVE-2010-3863Mediumorg.apache.shiro:shiro-root: Apache Shiro Path Traversal vulnerability

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.