Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2019-10093Mediumorg.apache.tika:tika-parsers: Allocation of Resources Without Limits or Throttling in Apache Tika CVE-2019-10094Highorg.apache.tika:tika-core: Allocation of Resources Without Limits or Throttling in Apache Tika CVE-2019-10184Highio.undertow:undertow-servlet: Undertow Missing Authorization when requesting a protected directory without trailing slash CVE-2019-14439Highcom.fasterxml.jackson.core:jackson-databind: Deserialization of untrusted data in FasterXML jackson-databind CVE-2019-14379Criticalcom.fasterxml.jackson.core:jackson-databind: Deserialization of untrusted data in FasterXML jackson-databind CVE-2018-11779Criticalorg.apache.storm:storm-kafka: Deserialization of Untrusted Data in Apache Storm CVE-2015-7559Mediumorg.apache.activemq:activemq-client: Improper Input Validation and Missing Authentication for Critical Function in Apache ActiveMQ CVE-2019-0193Highorg.apache.solr:solr-core: XML External Entity (XXE) Injection in Apache Solr CVE-2018-15890Criticalorg.ethereum:ethereumj-core: Deserialization of Untrusted Data in EthereumJ CVE-2019-10173Criticalcom.thoughtworks.xstream:xstream: Deserialization of Untrusted Data and Code Injection in xstream CVE-2019-12814Mediumcom.fasterxml.jackson.core:jackson-databind: Deserialization of untrusted data in FasterXML jackson-databind CVE-2018-11307Criticalcom.fasterxml.jackson.core:jackson-databind: Deserialization of Untrusted Data in jackson-databind CVE-2019-0228Criticalorg.apache.pdfbox:pdfbox: Vulnerability that affects org.apache.pdfbox:pdfbox CVE-2019-9827Criticalio.hawt:hawtio-core: Server-Side Request Forgery in Hawt Hawtio CVE-2019-9843Highcom.diffplug.spotless:spotless-plugin-gradle: Improper Restriction of XML External Entity Reference in DiffPlug Spotless CVE-2019-12384Mediumcom.fasterxml.jackson.core:jackson-databind: Deserialization of Untrusted Data in FasterXML jackson-databind CVE-2019-3875Mediumorg.keycloak:keycloak-core: Improper Certificate Validation and Insufficient Verification of Data Authenticity in Keycloak CVE-2019-11272Highorg.springframework.security:spring-security-core: Insufficiently Protected Credentials and Improper Authentication in Spring Security CVE-2019-10072Highorg.apache.tomcat.embed:tomcat-embed-core: Improper Locking in Apache Tomcat CVE-2017-15694Mediumorg.apache.geode:geode-core: Argument Injection in Apache Geode server CVE-2019-5442Highro.pippo:pippo-jaxb: XML Entity Expansion in Pippo CVE-2019-11269Mediumorg.springframework.security.oauth:spring-security-oauth: Open Redirect in Spring Security OAuth CVE-2019-3888Criticalio.undertow:undertow-core: Credential exposure through log files in Undertow CVE-2019-12741Mediumca.uhn.hapi.fhir:hapi-fhir-base: Cross-site Scripting in HAPI FHIR CVE-2019-10078Mediumorg.apache.jspwiki:jspwiki-war: Cross-site Scriptin in JSPWiki

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo