Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-68925Mediumnet.gleske:jervis: Jervis Has a JWT Algorithm Confusion Vulnerability CVE-2025-68704Highnet.gleske:jervis: Jervis Has Weak Random for Timing Attack Mitigation CVE-2025-68703Highnet.gleske:jervis: Jervis's Salt for PBKDF2 derived from password CVE-2025-68702Highnet.gleske:jervis: Jervis Has a SHA-256 Hex String Padding Bug CVE-2025-68701Highnet.gleske:jervis: Jervis has Deterministic AES IV Derivation from Passphrase CVE-2025-68698Highnet.gleske:jervis: Jervis Has a RSA PKCS#1 Padding Vulnerability CVE-2025-68493Highorg.apache.struts:struts2-core: Apache Struts 2 is Missing XML Validation CVE-2025-65091Criticalorg.xwiki.contrib:macro-fullcalendar-pom: XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService CVE-2025-65090Mediumorg.xwiki.contrib:macro-fullcalendar-pom: XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService CVE-2025-70974Criticalcom.alibaba:fastjson: FASTJSON Includes Functionality from Untrusted Control Sphere CVE-2026-0707Mediumorg.keycloak:keycloak-parent: Keycloak has Incorrect Behavior Order: Authorization Before Parsing and Canonicalization CVE-2026-22187Mediumome:pom-bio-formats: Bio-Formats performs unsafe Java deserialization of attacker-controlled memoization cache files (.bfmemo) during image processing CVE-2026-22186Mediumome:pom-bio-formats: Bio-Formats has an XML External Entity (XXE) vulnerability CVE-2026-22244Highorg.open-metadata:platform: OpenMetadata's Server-Side Template Injection (SSTI) in FreeMarker email templates leads to RCE CVE-2025-12543Criticalio.undertow:undertow-core: Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests CVE-2025-66560Mediumio.quarkus:quarkus-rest: Quarkus REST has potential worker thread starvation when HTTP connection is closed while waiting to write CVE-2025-61916Highio.spinnaker.clouddriver:clouddriver-artifacts: Spinnaker vulnerable to SSRF due to improper restrictions on http from user input CVE-2025-68280Mediumorg.apache.sis.core:sis-metadata: Apache SIS has Improper Restriction of XML External Entity Reference vulnerability CVE-2026-21452Highorg.msgpack:msgpack-core: MessagePack for Java Vulnerable to Remote DoS via Malicious EXT Payload Allocation CVE-2025-66518Highorg.apache.kyuubi:kyuubi-server_2.12: Apache Kyuubi Server vulnerable to Path Traversal CVE-2025-15022Mediumcom.vaadin:vaadin-server: Vaadin vulnerable to Cross-site Scripting CVE-2025-47411Mediumorg.apache.streampipes:streampipes-parent: Apache StreamPipes has Improper Privilege Management issue CVE-2025-13467Mediumorg.keycloak:keycloak-ldap-federation: Keycloak LDAP User Federation provider enables admin-triggered untrusted Java deserialization CVE-2025-66524Highorg.apache.nifi:nifi-asana-processors: Apache NiFi GetAsanaObject Processor has Remote Code Execution via Unsafe Deserialization CVE-2025-68390Mediumorg.elasticsearch.plugin:x-pack-core: Elasticsearch privileged authenticated users can cause DoS through Excessive Resource Allocation

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.