Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-61735Highorg.apache.kylin:kylin: Apache Kylin Server-Side Request Forgery (SSRF) Vulnerability CVE-2025-61734Highorg.apache.kylin:kylin: Apache Kylin Files or Directories Accessible to External Parties CVE-2025-11226Mediumch.qos.logback:logback-core: QOS.CH logback-core is vulnerable to Arbitrary Code Execution through file processing CVE-2025-43826Mediumcom.liferay.portal:release.portal.bom: Liferay Portal Vulnerable to XSS in Web Content translation CVE-2025-43827Mediumcom.liferay:com.liferay.portal.security.audit.web: Liferay Portal Vulnerable to IDOR via audit events CVE-2025-43812Mediumcom.liferay.portal:release.portal.bom: Liferay Portal vulnerable to cross-site scripting in the web content template CVE-2025-43820Mediumcom.liferay.portal:release.portal.bom: Liferay Portal vulnerable to cross-site scripting in the Calendar widget CVE-2025-43818Mediumcom.liferay:com.liferay.calendar.web: Liferay Portal vulnerable to cross-site scripting in the Calendar widget CVE-2025-43815Mediumcom.liferay:com.liferay.product.navigation.control.menu.web: Liferay Portal vulnerable to reflected cross-site scripting on the page configuration page CVE-2025-43811Mediumcom.liferay:com.liferay.item.selector.web: Liferay Portal vulnerable to cross-site scripting in the related asset selector CVE-2025-43817Mediumcom.liferay.portal:release.portal.bom: Liferay Portal vulnerable to reflected cross-site scripting via the `redirect` parameter CVE-2025-43813Mediumcom.liferay.portal:release.portal.bom: Liferay Portal vulnerable to path traversal and denial-of-service in the ComboServlet CVE-2025-59952Highio.minio:minio: MinIO Java Client XML Tag Value Substitution Vulnerability CVE-2025-1396Loworg.wso2.carbon.identity.framework:org.wso2.carbon.identity.input.validation.mgt: WSO2's Input Validation Management Service contains Observable Discrepancy when Multi-Attribute Login is enabled CVE-2025-56769Highcn.hutool:hutool-extra: Hutool allows remote code execution (RCE) via the QLExpressEngine class CVE-2025-43816Mediumcom.liferay:com.liferay.portal.vulcan.impl: Liferay Portal and DXP vulnerable to a memory leak CVE-2025-58457Mediumorg.apache.zookeeper:zookeeper: Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands CVE-2025-48459Criticalorg.apache.iotdb:iotdb-confignode: Apache IoTDB: Deserialization of untrusted Data CVE-2025-48392Mediumorg.apache.iotdb:iotdb-core: Apache IoTDB: DoS Vulnerability CVE-2025-43819Mediumcom.liferay:com.liferay.saml.impl: Liferay Portal and DXP does not properly expire sessions CVE-2024-6429Mediumorg.wso2.identity.apps:authentication-portal: WSO2 Identity Server Apps allows content spoofing in logs CVE-2025-59822Mediumorg.http4s:http4s-ember-core_2.12: Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section CVE-2025-4760Mediumorg.wso2.carbon.apimgt:org.wso2.carbon.apimgt.api: WSO2 carbon-apimgt affected by an authenticated stored cross-site scripting (XSS) vulnerability CVE-2025-43810Mediumcom.liferay.commerce:com.liferay.commerce.service: Liferay Portal and DXP allows users to add a note to a different virtual instance CVE-2025-43814Mediumcom.liferay:com.liferay.portal.security.audit.event.generators.user.management: Liferay Portal and DXP audit events record password reminder answers

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.