Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-50623Mediumorg.apache.cxf:cxf-rt-rs-security-oauth2: Apache CXF has Authentication Bypass in OAuth2 TokenIntrospectionServiceCVE-2026-49875Criticalorg.apache.cxf:cxf-core: Apache CXF has Improper Restriction of XML External Entity ReferenceCVE-2026-50630Mediumorg.apache.cxf:cxf-rt-rs-security-oauth2: Apache CXF OAuth2 HTTP Response Splitting via WWW-Authenticate Realm InjectionCVE-2025-27511Highorg.geoserver.extension:gs-db2: GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store ConnectionCVE-2026-48059Highio.netty:netty-codec-haproxy: Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory ExhaustionCVE-2026-11986Mediumorg.keycloak:keycloak-rest-admin-ui-ext: Keycloak Admin UI REST Extensions: bulk role-removal endpoints fail to perform granular permission checksCVE-2026-48043Mediumio.netty:netty-codec-http2: netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory ExhaustionCVE-2026-48040Mediumio.netty.incubator:netty-incubator-codec-ohttp-hpke-native-boringssl: netty-incubator-codec-ohttp's Incorrect Native Pointer Derivation in Pooled Direct ByteBuf Fallback Leads to Out-of-Bounds Native Memory…CVE-2026-48006Highio.netty:netty-codec-redis: Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregatorCVE-2026-41700Highorg.springframework.graphql:spring-graphql: Spring for GraphQL: Cross-Site WebSocket HijackingCVE-2026-41699Highorg.springframework.graphql:spring-graphql: Spring for GraphQL: Unsafe DeserializationCVE-2026-40996Mediumorg.springframework.ws:spring-ws-security: Spring Web Services: Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by defaultCVE-2026-40997Mediumorg.springframework.ws:spring-ws-security: Spring Web Services: SOAP security faults leak Spring Security account stateCVE-2026-41000Loworg.springframework.ws:spring-ws-security: Spring Web Services: WSS4J validation does not use configured replay cacheCVE-2026-40994Highorg.springframework.ws:spring-ws-security: Spring Web Services: Wss4jSecurityInterceptor disables WS-I BSP validation by defaultCVE-2026-41856Highorg.springframework.graphql:spring-graphql: Spring for GraphQL: Annotation Detection VulnerabilityCVE-2026-40998Highorg.springframework.ws:spring-xml: Spring Web Services: Jaxp13 XPath XXE via StreamSource and SAXSourceCVE-2026-40995Mediumorg.springframework.ws:spring-ws-security: Spring Web Services: X.509 authentication bypasses Spring Security account checksCVE-2026-40999Highorg.springframework.ws:spring-ws-core: Spring Web Services: SSRF via unvalidated WS-Addressing reply destinationsCVE-2026-41001Mediumorg.springframework.boot:spring-boot-autoconfigure: Spring Boot: Predictable Temp Directory in Artemis Auto-configurationCVE-2026-40987Highorg.springframework.integration:spring-integration-file: Spring Integration File Support: FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystemCVE-2026-40992Mediumorg.springframework.boot:spring-boot-starter-mail: Spring Boot's Mail Auto-Configuration Does Not Enable SSL Hostname VerificationCVE-2026-40986Mediumorg.springframework.webflow:spring-webflow: Spring Web Flow JS RemotingHandler renders non-HTML Response as HTMLCVE-2026-40985Mediumorg.springframework.webflow:spring-webflow: Spring Web Flow has Data Binding Vulnerability with Unified EL ParserCVE-2026-53698Mediumorg.silverpeas.core:silverpeas-core-war: Silverpeas mishandles the "Personal space" feature that is selected when no componentId is set

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo