Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-107726Criticalcom.hazelcast:hazelcast: Hazelcast allows arbitrary member memory access by low-privileged clientCVE-2026-107725Highcom.hazelcast:hazelcast: Hazelcast has an authorization bypass in IMap Predicates APICVE-2026-107228Mediumorg.asynchttpclient:async-http-client: AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)CVE-2026-107226Mediumorg.asynchttpclient:async-http-client: AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPSCVE-2026-107227Highorg.asynchttpclient:async-http-client: AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is…CVE-2026-107230Highorg.asynchttpclient:async-http-client: AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy loginsCVE-2026-107283Loworg.asynchttpclient:async-http-client: AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random sourceCVE-2026-107285Mediumorg.asynchttpclient:async-http-client: AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnelCVE-2026-107280Mediumorg.asynchttpclient:async-http-client: AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.ukCVE-2026-107282Criticalorg.asynchttpclient:async-http-client: AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new hostCVE-2026-107231Highorg.asynchttpclient:async-http-client: AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartextCVE-2026-106121Mediumcom.rabbitmq:amqp-client: RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoSCVE-2026-106451Highat.yawk.lz4:lz4-java: yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local userCVE-2026-106449Lowat.yawk.lz4:lz4-java: yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowErrorCVE-2026-106450Mediumat.yawk.lz4:lz4-java: yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputsCVE-2026-106122Mediumcom.rabbitmq:amqp-client: RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumersCVE-2026-106123Mediumcom.rabbitmq:amqp-client: RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()CVE-2026-106452Mediumat.yawk.lz4:lz4-java: yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream headerCVE-2026-106453Mediumat.yawk.lz4:lz4-java: yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB…CVE-2026-86597Mediumsnowflake-sdk: Snowflake drivers writes sensitive information to logsCVE-2026-103922Critical@capacitor/android: Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy pathCVE-2026-61586Higheu.copernik:copernik-xml-factory: Copernik XML Factory (stock JDK provider) has Improper restriction of XInclude resource resolutionCVE-2026-89425Highcom.fasterxml.jackson.core:jackson-core: jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)CVE-2026-89407Highcom.fasterxml.jackson.core:jackson-core: jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()CVE-2026-91777Highcom.fasterxml.jackson.core:jackson-databind: jackson-databind quadratic forward-reference completion

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo