Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2022-29037Mediumorg.jenkins-ci.plugins:cvs: Stored XSS in Jenkins CVS PluginCVE-2022-29036Mediumorg.jenkins-ci.plugins:credentials: Cross-site Scripting in Jenkins Credentials PluginCVE-2022-29043Mediumorg.jenkins-ci.plugins:mask-passwords: Stored Cross-site Scripting in Jenkins Mask Passwords PluginCVE-2022-29042Mediumorg.jenkins-ci.plugins:jobgenerator: Stored Cross-site Scripting vulnerability in Jenkins Job Generator PluginCVE-2022-29041Mediumorg.jenkins-ci.plugins:jira: Stored Cross-site Scripting vulnerability in Jenkins Jira PluginCVE-2022-29040Mediumorg.jenkins-ci.tools:git-parameter: Stored XSS vulnerability in Jenkins Git Parameter PluginCVE-2022-29047Highorg.jenkins-ci.plugins.workflow:workflow-cps-global-lib: Untrusted users can modify some Pipeline libraries in Jenkins Pipeline: Deprecated Groovy Libraries PluginCVE-2022-29046Mediumorg.jenkins-ci.plugins:subversion: Stored Cross-site Scripting vulnerability in Jenkins Subversion PluginCVE-2022-29051Mediumorg.jenkins-ci.plugins:publish-over-ftp: Missing permission checks in Jenkins Publish Over FTP PluginCVE-2022-29050Highorg.jenkins-ci.plugins:publish-over-ftp: CSRF vulnerability in Jenkins Publish Over FTP PluginCVE-2022-29044Mediumorg.jenkins-ci.plugins:nodelabelparameter: Stored Cross-site Scripting in Jenkins Node and Label parameter PluginCVE-2022-29049Highorg.jenkins-ci.plugins:promoted-builds: Promotion names in Jenkins promoted builds Plugin are not validated when using Job DSLCVE-2022-29048Mediumorg.jenkins-ci.plugins:subversion: CSRF vulnerability in Jenkins Subversion PluginCVE-2022-29045Highorg.jenkins-ci.plugins:promoted-builds: Stored Cross-site Scripting vulnerability in Jenkins Promoted Builds PluginCVE-2022-29052Mediumorg.jenkins-ci.plugins:google-compute-engine: Private key stored in plain text by Jenkins Google Compute Engine PluginCVE-2022-24827Highcom.yahoo.elide:elide-datastore-aggregation: SQL Injection in elide-datastore-aggregationCVE-2022-24820Mediumorg.xwiki.platform:xwiki-platform-web: Unauthenticated user can list hidden document from multiple velocity templates in XWikiCVE-2022-24821Mediumorg.xwiki.platform:xwiki-platform-skin-skinx: Incorrect Use of Privileged APIs in org.xwiki.platform.skin.skinxCVE-2022-24819Mediumorg.xwiki.platform:xwiki-platform-web-templates: Unauthenticated user can retrieve the list of users through uorgsuggest.vmCVE-2022-26612Criticalorg.apache.hadoop:hadoop-common: Path traversal in HadoopCVE-2022-26585Highnet.mingsoft:ms-mcms: SQL injection in net.mingsoft:ms-mcmsCVE-2022-23974Highorg.apache.pinot:pinot: Logic error in Apache PinotCVE-2021-44138Highcom.caucho:resin: Path Traversal in Caucho ResinCVE-2021-3461Highorg.keycloak:keycloak-parent: Keycloak insufficient session expirationCVE-2022-22950Mediumorg.springframework:spring-expression: Allocation of Resources Without Limits or Throttling in Spring Framework

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo