Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-64144Mediumio.jenkins.plugins:byteguard-build-actions: Jenkins ByteGuard Build Actions Plugin stores API tokens unencrypted in job config.xml files CVE-2025-62784Mediumde.themoep:inventorygui: InventoryGui allows item duplication in GUIs which use GuiStorageElement CVE-2025-12390Mediumorg.keycloak:keycloak-services: Keycloak vulnerable to session takeovers due to reuse of session identifiers CVE-2025-62258Highcom.liferay.portal:release.portal.bom: Liferay Portal Vulnerable to CSRF in Headless APIs CVE-2025-62260Highcom.liferay.portal:release.portal.bom: Liferay Portal Vulnerable to DoS via Crafted Headless API Request CVE-2025-62259Mediumcom.liferay.portal:release.portal.bom: Liferay Portal Does Not Limit Access to APIs Before Email Verification CVE-2025-62261Mediumcom.liferay.portal:release.portal.bom: Liferay Portal Stores Password Reset Tokens in Plain Text CVE-2025-62262Mediumcom.liferay:com.liferay.portal.security.ldap.impl: Liferay Portal Vulnerable to Information Exposure Through a Log File Vulnerability in LDAP Import Feature CVE-2025-62263Mediumcom.liferay:com.liferay.account.admin.web: Liferay Portal Vulnerable to Cross-Site Scripting CVE-2025-62253Mediumcom.liferay:com.liferay.layout.admin.web: Liferay Portal Vulnerable to Open Redirect via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter CVE-2025-11419Highorg.keycloak:keycloak-quarkus-dist: Keycloak TLS Client-Initiated Renegotiation Denial of Service CVE-2025-62782Mediumde.themoep:inventorygui: InventoryGui allows item duplication with experimental "Bundle" item in GUIs which use GuiStorageElement CVE-2025-62783Mediumde.themoep:inventorygui: InventoryGui affected by item duplication in GUIs which use GuiStorageElement CVE-2025-55754Loworg.apache.tomcat:tomcat: Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences CVE-2025-61795Loworg.apache.tomcat:tomcat: Apache Tomcat Vulnerable to Improper Resource Shutdown or Release CVE-2025-55752Highorg.apache.tomcat:tomcat: Apache Tomcat Vulnerable to Relative Path Traversal CVE-2025-12194Mediumorg.bouncycastle:bc-fips: Bouncy Castle Vulnerable to Uncontrolled Resource Consumption CVE-2025-62254Mediumcom.liferay.portal:com.liferay.portal.impl: Liferay Portal ComboServlet denial of service via large file combination CVE-2025-62255Lowcom.liferay:com.liferay.knowledge.base.web: Liferay Portal Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page CVE-2025-60837Mediumnet.mingsoft:ms-mcms: MCMS reflected cross-site scripting (XSS) vulnerability CVE-2025-12110Mediumorg.keycloak:keycloak-services: Keycloak does not invalidate offline sessions when the offline_access scope is removed CVE-2025-62256Mediumcom.liferay:com.liferay.portal.security.auth.verifier: Liferay Portal and DXP do not properly restrict access to OpenAPI CVE-2025-11429Mediumorg.keycloak:keycloak-services: Keycloak does not invalidate sessions when "Remember Me" is disabled CVE-2025-62247Lowcom.liferay:com.liferay.search.experiences.service: Liferay Portal and DXP are Missing Authorization in Collection Provider CVE-2025-62248Mediumcom.liferay:com.liferay.dynamic.data.mapping.web: Liferay Portal and Liferay DXP vulnerable to reflected cross-site scripting (XSS)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.