Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2021-35516Highorg.apache.commons:commons-compress: Improper Handling of Length Parameter Inconsistency in CompressCVE-2021-35515Highorg.apache.commons:commons-compress: Excessive Iteration in CompressCVE-2021-30129Highorg.apache.sshd:sshd-mina: Buffer Overflow in Apache Mina SSHDCVE-2020-27178Highorg.apereo.cas:cas-server-webapp: Improper Authentication in Apereo CASCVE-2020-19676Mediumcom.alibaba.nacos:nacos-common: Incorrect Access Control in NacosCVE-2021-33813Highorg.jdom:jdom2: XML External Entity (XXE) Injection in JDOMCVE-2021-32769Highio.micronaut:micronaut-http-server-netty: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in micronaut-coreCVE-2021-32012Mediumxlsx: Denial of Service in SheetJS ProCVE-2021-32013Mediumxlsx: Denial of Service in SheetsJS ProCVE-2021-32014Mediumxlsx: Denial of Service in SheetJS ProCVE-2021-34429Mediumorg.eclipse.jetty:jetty-webapp: Encoded URIs can access WEB-INF directory in Eclipse JettyCVE-2021-3637Highorg.keycloak:keycloak-model-infinispan: Allocation of resources without limits or throttling in keycloak-model-infinispanCVE-2021-32729Loworg.xwiki.platform:xwiki-platform-security-authentication-script: A user without PR can reset user authentication failures informationCVE-2021-32730Mediumorg.xwiki.platform:xwiki-platform-administration-ui: No CSRF protection on the password change formCVE-2021-32731Mediumorg.xwiki.platform:xwiki-platform-web: The reset password form reveal users email addressCVE-2021-21672Mediumorg.jenkins-ci.plugins:seleniumhtmlreport: XXE vulnerability in Jenkins Selenium HTML report PluginCVE-2021-22119Highorg.springframework.security:spring-security-core: Resource Exhaustion in Spring SecurityCVE-2021-22135Mediumorg.elasticsearch:elasticsearch: API information disclosure flaw in ElasticsearchCVE-2021-29479Highio.ratpack:ratpack-core: Cached redirect poisoning via X-Forwarded-Host headerCVE-2021-29480Mediumio.ratpack:ratpack-session: Ratpack's default client side session signing key is highly predictableCVE-2021-29481Mediumio.ratpack:ratpack-session: Unencrypted storage of client side sessionsCVE-2021-29485Criticalio.ratpack:ratpack-core: Remote Code Execution Vulnerability in Session StorageCVE-2021-33604Lowcom.vaadin:vaadin-bom: Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19CVE-2021-31412Mediumcom.vaadin:vaadin-bom: Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19GHSA-8VFW-V2JV-9HWCLowcom.vaadin:flow-server: Reflected cross-site scripting in development mode handler in Vaadin

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo