Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-62276Mediumcom.liferay:com.liferay.adaptive.media.web: Liferay Portal and DXP use an incorrect cache-control header CVE-2025-62267Mediumcom.liferay:com.liferay.dynamic.data.mapping.item.selector.web: Liferay Portal and DXP affected by multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page CVE-2025-62264Mediumcom.liferay.portal:release.portal.bom: Liferay Portal Vulnerable to Reflected XSS via the selectedLanguageId Parameter CVE-2025-62265Mediumcom.liferay.portal:release.portal.bom: Liferay Portal is vulnerable to XSS in the Blogs widget CVE-2025-62266Mediumcom.liferay.portal:release.portal.bom: Liferay Portal is vulnerable to DNS rebinding attacks CVE-2025-62257Mediumcom.liferay.portal:release.portal.bom: Liferay Portal vulnerable to password enumeration CVE-2025-64148Mediumorg.jenkins-ci.plugins:publish-to-bitbucket: Jenkins Publish to Bitbucket Plugin is missing a permissions check CVE-2025-64150Mediumorg.jenkins-ci.plugins:publish-to-bitbucket: Jenkins Publish to Bitbucket Plugin is missing a permissions check CVE-2025-64149Mediumorg.jenkins-ci.plugins:publish-to-bitbucket: Jenkins Publish to Bitbucket Plugin vulnerable to CSRF and missing permissions check CVE-2025-64147Mediumorg.jenkins-ci.plugins:curseforge-publisher: Jenkins Curseforge Publisher Plugin does not mask API Keys displayed on the job configuration form CVE-2025-64135Mediumio.jenkins.plugins:eggplant-runner: Jenkins Eggplant Runner Plugin protection mechanism disabled CVE-2025-64133Mediumjp.ikedam.jenkins.plugins:extensible-choice-parameter: Jenkins Extensible Choice Parameter Plugin vulnerable to cross-site request forgery CVE-2025-64137Mediumorg.jenkins-ci.plugins:themis: Jenkins Themis Plugin is missing a permission check CVE-2025-64132Mediumio.jenkins.plugins:mcp-server: Jenkins MCP Server Plugin does not perform permission checks in multiple MCP tools CVE-2025-64136Mediumorg.jenkins-ci.plugins:themis: Jenkins Themis Plugin vulnerable to cross-site request forgery CVE-2025-64140Highorg.jenkins-ci.plugins:azure-cli: Jenkins Azure CLI Plugin does not restrict the commands it executes CVE-2025-64139Mediumorg.jenkins-ci.plugins:windocks-start-container: Jenkins Start Windocks Containers Plugin is missing a permission check CVE-2025-64134Highorg.jenkins-ci.plugins:jdepend: Jenkins JDepend Plugin vulnerable to XML external entity attacks CVE-2025-64145Mediumio.jenkins.plugins:byteguard-build-actions: Jenkins ByteGuard Build Actions Plugin does not mask API tokens displayed on the job configuration form CVE-2025-64143Mediumcom.openshift.jenkins:openshift-pipeline: Jenkins OpenShift Pipeline Plugin stores authorization tokens unencrypted in job config.xml files CVE-2025-64142Mediumorg.jenkins-ci.plugins:nexus-task-runner: Jenkins Nexus Task Runner Plugin is missing a permission check CVE-2025-64141Mediumorg.jenkins-ci.plugins:nexus-task-runner: Jenkins Nexus Task Runner Plugin vulnerable to cross-site request forgery CVE-2025-64146Mediumorg.jenkins-ci.plugins:curseforge-publisher: Jenkins Curseforge Publisher Plugin stores API Keys unencrypted in job config.xml files CVE-2025-64138Mediumorg.jenkins-ci.plugins:windocks-start-container: Jenkins Start Windocks Containers Plugin vulnerable to cross-site request forgery CVE-2025-64131Highorg.jenkins-ci.plugins:saml: Jenkins SAML Plugin does not implement a replay cache

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo