Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2025-43806Mediumcom.liferay:com.liferay.headless.batch.engine.impl: Liferay Portal and DXP does not properly check permission with import and export tasksCVE-2025-43807Mediumcom.liferay:com.liferay.change.tracking.service: Liferay has a stored cross-site scripting (XSS) vulnerability via a a publication’s “Name” text fieldCVE-2025-6544Criticalai.h2o:h2o-core: H2O affected by a deserialization vulnerabilityCVE-2025-43808Mediumcom.liferay.commerce:com.liferay.commerce.product.type.virtual.service: Liferay Portal Commerce component has Incorrect Permission Assignment for Critical ResourceCVE-2025-43809Mediumcom.liferay.portal:com.liferay.portal.impl: Liferay Portal Cross-Site Request Forgery (CSRF) vulnerabilityCVE-2025-43803Mediumcom.liferay:com.liferay.contacts.web: Liferay Contacts Center widget has insecure direct object referenceCVE-2025-8419Mediumorg.keycloak:keycloak-services: Keycloak SMTP Inject VulnerabilityCVE-2025-59340Criticalcom.hubspot.jinjava:jinjava: jinjava has Sandbox Bypass via JavaType-Based DeserializationCVE-2025-59475Mediumorg.jenkins-ci.main:jenkins-core: Jenkins is missing a permission check in the authenticated users' profile menu CVE-2025-59476Mediumorg.jenkins-ci.main:jenkins-core: Jenkins has a log message injection vulnerabilityCVE-2025-59474Mediumorg.jenkins-ci.main:jenkins-core: Jenkins has a missing permission check, allowing users to obtain agent namesCVE-2025-43804Mediumcom.liferay:com.liferay.portal.search: Liferay search widget vulnerable to Cross-site ScriptingCVE-2025-43805Mediumcom.liferay:com.liferay.asset.display.page.service: Liferay Portal allows remote attackers to view display page templates via crafted URLsCVE-2025-59432Mediumcom.ongres.scram:scram-common: Timing Attack Vulnerability in SCRAM AuthenticationCVE-2025-43801Mediumcom.liferay.portal:com.liferay.portal.impl: Liferay Portal has unchecked input for loop condition vulnerability in XML-RPCCVE-2025-10492Highnet.sf.jasperreports:jasperreports: JasperReports has a Java deserialisation vulnerabilityCVE-2025-41243Criticalorg.springframework.cloud:spring-cloud-gateway-server-webflux: Spring Expression language property modification using Spring Cloud Gateway Server WebFluxCVE-2025-41249Highorg.springframework:spring-core: Spring Framework annotation detection mechanism may result in improper authorizationCVE-2025-41248Highorg.springframework.security:spring-security-core: Spring Security annotation detection mechanism has authorization bypassCVE-2025-59154Mediumorg.igniterealtime.openfire:xmppserver: Openfire has potential identity spoofing issue via unsafe CN parsingCVE-2025-43797Mediumcom.liferay:com.liferay.site.admin.web: Liferay has Insecure Default Initialization of Resource issueCVE-2025-43802Mediumcom.liferay.workspace:com.liferay.ticket.workspace: Liferay Stored Cross-site Scripting vulnerabilityCVE-2025-43798Lowcom.liferay:com.liferay.multi.factor.authentication.timebased.otp.web: Liferay DXP Missing Critical Step in AuthenticationCVE-2025-43799Mediumcom.liferay.portal:release.portal.bom: Liferay Portal Uses Default PasswordCVE-2025-43800Mediumcom.liferay:com.liferay.dynamic.data.mapping.form.field.type: Liferay Portal Cross-site Scripting (XSS) vulnerability

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo