Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-7303Lowcom.xuxueli:xxl-job-admin: xxl-job has a Resource Injection issueCVE-2026-40969Loworg.springframework.grpc:spring-grpc: Spring gRPC AuthenticationException messages are reflected to remote clientCVE-2026-40968Mediumorg.springframework.grpc:spring-grpc: Spring gRPC SecurityContext leaks across requests upon authorization failureCVE-2026-41603Highorg.apache.thrift:libthrift: Apache Thrift has an issue with Java TSSLTransportFactory hostname verificationCVE-2026-40978Highorg.springframework.ai:spring-ai-azure-cosmos-db-store: Spring AI has SQL Injection in CosmosDBVectorStore.doDelete()CVE-2026-40979Mediumorg.springframework.ai:spring-ai-transformers: Spring AI's ONNX model cache defaults to world-writable predictable /tmp directoryCVE-2026-40980Mediumorg.springframework.ai:spring-ai-pdf-document-reader: Spring AI Vulnerable to OOM by attacker-controlled PDFCVE-2026-40966Mediumorg.springframework.ai:spring-ai-advisors-vector-store: Spring AI's VectorStoreChatMemoryAdvisor conversation scoping can lead to cross-tenant memory exfiltrationCVE-2026-40967Highorg.springframework.ai:spring-ai-vector-store: Spring AI has a VectorStore FilterExpression Converter injectionCVE-2026-40977Mediumorg.springframework.boot:spring-boot-cassandra: Spring Boot's PID file write follows symlinks at predictable default pathCVE-2026-40973Highorg.springframework.boot:spring-boot: Spring Boot accepts predictable temp directory without ownership verificationCVE-2026-40974Mediumorg.springframework.boot:spring-boot-cassandra: Spring Boot's Cassandra SSL auto-configuration disables TLS hostname verificationCVE-2026-40975Mediumorg.springframework.boot:spring-boot-cassandra: Spring Boot's random value property source uses a weak PRNG unsuitable for secretsCVE-2026-40976Criticalorg.springframework.boot:spring-boot: Spring Boot's default security filter chain has no authorization rule with Actuator but without HealthCVE-2026-40971Mediumorg.springframework.boot:spring-boot-rabbitmq: Spring Boot's RabbitMQ auto-configuration doesn't perform hostname verification when connecting to the RabbitMQ brokerCVE-2026-40972Highorg.springframework.boot:spring-boot-devtools: Spring Boot DevTools remote secret comparison is vulnerable to timing attacksCVE-2026-40970Mediumorg.springframework.boot:spring-boot-elasticsearch: Spring Boot's Elasticsearch auto-configuration doesn't perform hostname verification when connecting to the Elasticsearch server.CVE-2026-40557Mediumorg.apache.storm:storm-metrics-prometheus: Apache Storm Prometheus Reporter vulnerable to Improper Certificate Validation via Global SSL Context DowngradeCVE-2026-41081Mediumorg.apache.storm:storm-client: Apache Storm's Improper Handling of TLS Client Authentication Failure Leads to Anonymous Principal AssignmentCVE-2026-27172Mediumorg.apache.camel:camel-consul: Apache Camel-Consul component vulnerable to Deserialization of Untrusted DataCVE-2026-33453Criticalorg.apache.camel:camel-coap: Apache camel-coap allows header injection that can lead to remote code executionCVE-2026-40858Highorg.apache.camel:camel-infinispan: Apache Camel-Infinispan Component Vulnerable to Deserialization of Untrusted DataCVE-2026-40022Highorg.apache.camel:camel-platform-http-main: Apache Camel Vulnerable to Authentication Bypass Using an Alternate Path or ChannelCVE-2026-33454Criticalorg.apache.camel:camel-mail: Apache Camel's Camel-Mail component is vulnerable to Camel message header injectionCVE-2026-41409Criticalorg.apache.mina:mina-core: Apache MINA Vulnerable to Deserialization of Untrusted Data (CVE-2024-52046 Incomplete Fix)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo