Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-67640Mediumorg.jenkins-ci.plugins:git-client: Jenkins Git client Plugin has an OS command injection vulnerability on agents in Git client Plugin CVE-2025-66474Highorg.xwiki.rendering:xwiki-rendering-xml: XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection CVE-2025-66473Highorg.xwiki.platform:xwiki-platform-rest-server: XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis CVE-2025-66472Mediumorg.xwiki.platform:xwiki-platform-flamingo-skin-resources: XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication CVE-2025-66675Highorg.apache.struts:struts2-core: Apache Struts has a Denial of Service vulnerability CVE-2025-14082Loworg.keycloak:keycloak-services: Keycloak Admin REST (Representational State Transfer) API does not properly enforce permissions CVE-2025-14306Criticalnet.sf.robocode:robocode.core: Robocode vulnerable to Directory Traversal in recursivelyDelete Method CVE-2025-14307Criticalnet.sf.robocode:robocode.battle: Robocode has an insecure temporary file creation vulnerability in the AutoExtract component GHSA-93FV-4PM9-XP28Mediumnet.dv8tion:JDA: JDA (Java Discord API) downloads external URLs when updating message components CVE-2025-66623Highio.strimzi:strimzi: Strimzi allows unrestricted access to all Secrets in the same Kubernetes namespace from Kafka Connect and MirrorMaker 2 operands CVE-2025-66566Highat.yawk.lz4:lz4-java: yawkat LZ4 Java has a possible information leak in Java safe decompressor CVE-2025-66516Criticalorg.apache.tika:tika-core: Apache Tika has XXE vulnerability CVE-2025-11222Mediumcom.linecorp.centraldogma:centraldogma-server-auth-shiro: Central Dogma's Login Function Has an Open Redirect Vulnerability CVE-2024-3884Highio.undertow:undertow-core: Undertow OutOfMemory when parsing form data encoding with application/x-www-form-urlencoded CVE-2025-66453Loworg.mozilla:rhino: Rhino has high CPU usage and potential DoS when passing specific numbers to `toFixed()` function CVE-2025-13472Mediumcom.blazemeter.plugins:BlazeMeterJenkinsPlugin: BlazeMeter Jenkins Plugin is Missing Authorization for Available Resources CVE-2025-10939Loworg.keycloak:keycloak-quarkus-server: Keycloak unable to restrict access to the admin console CVE-2025-11538Mediumorg.keycloak:keycloak-quarkus-dist: Keycloak has debug default bind address CVE-2025-14874Highnodemailer: Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls CVE-2025-55749Highorg.xwiki.platform:xwiki-platform-tool-jetty-resources: XWiki Jetty Package (XJetty) allows accessing any application file through URL CVE-2025-64775Highorg.apache.struts:struts2-core: Apache Struts is Vulnerable to DoS via File Leak CVE-2025-13805Loworg.nutz:nutzboot-parent: NutzBoot vulnerable to deserialization CVE-2025-13806Mediumorg.nutz:nutzboot-parent: NutzBoot Incorrect Privilege Assignment vulnerability CVE-2025-13804Loworg.nutz:nutzboot-parent: NutzBoot vulnerable to information disclosure CVE-2025-12183Highat.yawk.lz4:lz4-java: LZ4 Java Compression has Out-of-bounds memory operations which can cause DoS

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.