Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2020-9488Loworg.apache.logging.log4j:log4j: Improper validation of certificate with host mismatch in Apache Log4j SMTP appender CVE-2019-12423Highorg.apache.cxf:apache-cxf: Private key leak in Apache CXF CVE-2020-11973Criticalorg.apache.camel:camel-netty: Apache Camel Netty enables Java deserialization by default CVE-2020-1941Mediumorg.apache.activemq:activemq-web-console: Apache ActiveMQ webconsole admin GUI is open to XSS CVE-2020-5529Highnet.sourceforge.htmlunit:htmlunit: Code execution vulnerability in HtmlUnit CVE-2020-1953Criticalorg.apache.commons:commons-configuration2: Remote code execution in Apache Commons Configuration CVE-2020-9484Highorg.apache.tomcat:tomcat-catalina: Potential remote code execution in Apache Tomcat CVE-2020-7656Mediumjquery-rails: Cross-Site Scripting in jquery CVE-2020-9547Criticalcom.fasterxml.jackson.core:jackson-databind: jackson-databind mishandles the interaction between serialization gadgets and typing CVE-2019-14893Highcom.fasterxml.jackson.core:jackson-databind: Polymorphic deserialization of malicious object in jackson-databind CVE-2020-10673Highcom.fasterxml.jackson.core:jackson-databind: jackson-databind mishandles the interaction between serialization gadgets and typing CVE-2020-9548Criticalcom.fasterxml.jackson.core:jackson-databind: jackson-databind mishandles the interaction between serialization gadgets and typing CVE-2019-14892Highcom.fasterxml.jackson.core:jackson-databind: Polymorphic deserialization of malicious object in jackson-databind CVE-2020-10968Highcom.fasterxml.jackson.core:jackson-databind: jackson-databind mishandles the interaction between serialization gadgets and typing CVE-2020-11111Highcom.fasterxml.jackson.core:jackson-databind: jackson-databind mishandles the interaction between serialization gadgets and typing CVE-2020-11113Highcom.fasterxml.jackson.core:jackson-databind: jackson-databind mishandles the interaction between serialization gadgets and typing CVE-2020-11619Highcom.fasterxml.jackson.core:jackson-databind: jackson-databind mishandles the interaction between serialization gadgets and typing CVE-2020-7647Mediumio.jooby:jooby: path traversal in Jooby CVE-2019-12399Highorg.apache.kafka:kafka: Exposure of Sensitive Information to an Unauthorized Actor in Apache Kafka CVE-2020-11050Highorg.java-websocket:Java-WebSocket: Improper Validation of Certificate with Host Mismatch in Java-WebSocket CVE-2020-1929Highorg.apache.beam:beam-sdks-java-io-mongodb: Improper Certificate Validation in Apache Beam CVE-2020-11023Mediumjquery: Potential XSS vulnerability in jQuery CVE-2020-11022Mediumjquery-rails: Potential XSS vulnerability in jQuery CVE-2020-11009Mediumorg.rundeck:rundeck: IDOR can reveal execution data and logs to unauthorized user in Rundeck CVE-2020-10969Highcom.fasterxml.jackson.core:jackson-databind: jackson-databind mishandles the interaction between serialization gadgets and typing

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo