Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-91776Highcom.fasterxml.jackson.core:jackson-databind: jackson-databind retains every unknown raw type ID CVE-2026-83557Mediumtools.jackson.core:jackson-databind: jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator…CVE-2026-68497Hightools.jackson.core:jackson-databind: jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoSCVE-2026-19032Mediumtools.jackson.core:jackson-databind: jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider ResolutionCVE-2026-77310Mediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserializationCVE-2026-61741Criticalorg.http4s:http4s-scala-xml_2.12: http4s-scala-xml has an XML External Entity (XXE) processing issueCVE-2026-61814Highorg.typelevel:jawn-parser_2.12: Jawn: Quadratic parsing effort in AsyncParserCVE-2026-59990Highorg.typelevel:jawn-parser_2.12: Jawn: Uncontrolled nesting depth in JSON parserCVE-2026-77421Mediumorg.jline:jline-builtins: JLine: ReDoS in Nano Editor Regex Search ModeCVE-2026-77422Highorg.jline:jline-builtins: JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` WrappingCVE-2026-77420Mediumorg.jline:jline-reader: JLine: ReDoS via `HISTORY_IGNORE` Configuration VariableCVE-2026-85724Criticalio.moquette:moquette-broker: Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message…CVE-2026-69190Mediumorg.graylog2:graylog2-server: Graylog: Manager-to-Owner privilege escalation on saved searches and dashboardsCVE-2026-65829MediumMPXJ.Net: MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readersCVE-2026-61570Highnet.sf.mpxj:mpxj: MPXJ: XXE Vulnerability in MerlinReaderCVE-2026-85058Highio.moquette:moquette-broker: io.moquette:moquette-broker has a Missing Authorization issueCVE-2025-53837Criticalorg.xwiki.rendering:xwiki-rendering-xml: org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issueCVE-2026-77615Highorg.opencastproject:opencast-engage-paella-player-7: Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue textCVE-2026-81876Highca.uhn.hapi.fhir:org.hl7.fhir.r5: HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of serviceCVE-2026-81875Highca.uhn.hapi.fhir:org.hl7.fhir.r5: HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of serviceCVE-2026-85717Mediumorg.asynchttpclient:async-http-client: AsyncHttpClient re-sends client-wide realm credentials to a cross-origin redirect targetCVE-2026-85720Mediumorg.asynchttpclient:async-http-client: AsyncHttpClient sends origin credentials to the proxy on the plaintext CONNECT requestCVE-2026-85721Highorg.asynchttpclient:async-http-client: AsyncHttpClient's unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of serviceCVE-2026-85716Loworg.asynchttpclient:async-http-client: AsyncHttpClient doesn't verify SCRAM and Digest mutual-authentication responsesCVE-2026-73245Mediumio.kestra:kestra: Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo