Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-40988Highorg.springframework.security:spring-security-saml2-service-provider: Spring Security SAML2 Service Provider: Unbounded writer inflates the compressed SAML payload into memory (DoS)CVE-2026-41717Highorg.springframework.data:spring-data-mongodb: Spring Data MongoDB is vulnerable to SpEL (Spring Expression Language) expression injectionCVE-2026-41706Mediumorg.springframework.security:spring-security-web: Spring Security: Open Redirect via Unvalidated Post-Login Redirect URL Stored in CookieRequestCacheCVE-2026-41697Mediumorg.springframework.data:spring-data-relational: Spring Data Relational: Attackers can supply wildcard characters to perform boolean-based blind data inferenceCVE-2026-41008Mediumorg.springframework.security:spring-security-oauth2-authorization-server: Spring Security OAuth2 Authorization Server: Authorization endpoint performs insufficient validation of the request_uri parameterCVE-2026-41701Mediumorg.springframework.amqp:spring-amqp: Spring AMQP Has Predictable Correlation IDs in RabbitTemplate.sendAndReceive() with Fixed Reply QueueCVE-2026-41716Highorg.springframework.data:spring-data-commons: Spring Data Commons: Heap exhaustion from unbounded property-lookup cache retaining crafted string keysCVE-2026-41696Mediumorg.springframework.data:spring-data-mongodb: Spring Data MongoDB Has Regex Parameter Binding Injection in @Query Repository MethodsCVE-2026-41003Highorg.springframework.security:spring-security-saml2-service-provider: Spring Security SAML2 Service Provider: RelyingPartyRegistration may run arbitrary code on HTML forms generated by Spring Security filtersCVE-2026-41854Mediumorg.springframework:spring-web: Spring Framework Server-Side Request Forgery via UriComponentsBuilderCVE-2026-41855Highorg.springframework:spring-jms: Spring Framework Unsafe Deserialization via Jackson JMS ConvertersCVE-2026-41852Loworg.springframework:spring-expression: Spring Framework Arbitrary Method Invocation in SpEL ExpressionsCVE-2026-41853Mediumorg.springframework:spring-webmvc: Spring Framework Multipart Request Smuggling in Spring MVC and WebFluxCVE-2026-41851Mediumorg.springframework:spring-expression: Spring Framework Denial of Service via Unbounded Cache in SpELCVE-2026-41850Highorg.springframework:spring-expression: Spring Framework Algorithmic Denial of Service via SpEL ExpressionsCVE-2026-41847Mediumorg.springframework:spring-webflux: Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSLCVE-2026-41849Highorg.springframework:spring-expression: Spring Framework Denial of Service via Integer Overflow in SpEL ExpressionsCVE-2026-41848Loworg.springframework:spring-core: Spring Framework Denial of Service via AntPathMatcherCVE-2026-41846Mediumorg.springframework:spring-webmvc: Spring Framework Cross-site Scripting via JSP Form TagsCVE-2026-41843Mediumorg.springframework:spring-webmvc: Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFluxCVE-2026-41844Mediumorg.springframework:spring-webmvc: Spring Framework Open Redirect in Spring MVC and WebFluxCVE-2026-41720Highorg.springframework.ldap:spring-ldap-core: Spring LDAP has Authentication Bypass with Empty PasswordCVE-2026-41845Highorg.springframework:spring-webmvc: Spring Framework Cross-site Scripting via JavaScriptUtilsCVE-2026-41838Mediumorg.springframework:spring-websocket: Spring Framework Predictable Session ID in WebSocket ModuleCVE-2026-41839Mediumorg.springframework:spring-webflux: Spring Framework Escalation via Session Fixation in WebFlux

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo