Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2025-53114Highorg.cometd.java:cometd-java-server-common: Acknowledgement extension out of memoryCVE-2026-53439Mediumorg.jenkins-ci.main:jenkins-core: Jenkins exposes other users' timezone and view names to users with Overall/Read permissionCVE-2026-53442Mediumorg.jenkins-ci.main:jenkins-core: Jenkins does not encrypt secrets from POST config.xml submissions before storing them in job configurationsCVE-2026-53436Mediumorg.jenkins-ci.main:jenkins-core: Jenkins Open Redirect via Relative Path Segments in Post-Login Redirect URLCVE-2026-53441Highorg.jenkins-ci.main:jenkins-core: Jenkins: Stored XSS vulnerability in node offline cause description CVE-2026-53437Mediumorg.jenkins-ci.main:jenkins-core: Jenkins Open Redirect Through Newline/Tab Characters in Redirect URLCVE-2026-53440Mediumorg.jenkins-ci.main:jenkins-core: Jenkins: Open Redirect phishing attacks possible via "from" parameter in "Delegate to servlet container"CVE-2026-53435Highorg.jenkins-ci.main:jenkins-core: Jenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonationCVE-2026-53438Mediumorg.jenkins-ci.main:jenkins-core: Jenkins: Missing permission check allows unauthorized cancellation of queue itemsCVE-2026-47838Mediumorg.springframework.security:spring-security-web: Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client CertificatesCVE-2026-41732Highorg.springframework.pulsar:spring-pulsar: Spring for Apache Pulsar: JsonPulsarHeaderMapper Trusted-Package Prefix Check Allows Unintended Subpackage DeserializationCVE-2026-41719Mediumorg.springframework.data:spring-data-keyvalue: Spring Data KeyValue: Remote code execution via SpEL Injection in Sort-based repository queriesCVE-2026-41837Mediumorg.springframework.data:spring-data-rest-core: Spring Data REST Querydsl Integration Exposes Persistent Property Paths, Bypassing Jackson CustomizationsCVE-2026-41730Mediumorg.springframework.data:spring-data-rest-core: Spring Data REST potentially exposes persistence-layer internals to HTTP clientsCVE-2026-41727Mediumorg.springframework.kafka:spring-kafka: Spring for Apache Kafka: Improper Validation of Retry Topic Header Values Leads to Retry Sequence ManipulationCVE-2026-41729Highorg.springframework.data:spring-data-rest-core: Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch requestsCVE-2026-41726Mediumorg.springframework.kafka:spring-kafka: In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector headerCVE-2026-41728Highorg.springframework.data:spring-data-rest-core: Spring Data REST has Improper Access Control in its JSON Patch ImplementationCVE-2026-41721Mediumorg.springframework.data:spring-data-commons: Spring Data Commons: Denial of Service via excessive memory allocation in projection bindingCVE-2026-41731Highorg.springframework.kafka:spring-kafka: In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserializationCVE-2026-41711Mediumorg.springframework.data:spring-data-commons: Spring Data Commons: StackOverflowException when parsing Sort parameters (DoS)CVE-2026-41714Mediumorg.springframework.amqp:spring-amqp: Spring AMQP Core: Missing Certificate and Hostname Verification for amqps URIs in RabbitConnectionFactoryBeanCVE-2026-41694Loworg.springframework.security:spring-security-saml2-service-provider: Spring Security SAML2 Service Provider: Decryption Oracle Vulnerability from Unsigned SAML Response and Logout PayloadsCVE-2026-40993Highorg.springframework.security:spring-security-saml2-service-provider: Spring Security SAML2 Service Provider is vulnerable to Deserialization of Untrusted Data via JdbcAssertingPartyMetadataRepositoryCVE-2026-40991Mediumorg.springframework.restdocs:spring-restdocs-webtestclient: Spring REST Docs REST Assured & WebFlux are vulnerable to Improper Restriction of XML External Entity Reference

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo