Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-2366Low@keycloak/keycloak-admin-client: Keycloak vulnerable to authorization bypass via the Admin APICVE-2026-3429Mediumorg.keycloak:keycloak-services: Keycloak: Improper Access Control Leading to MFA Deletion and Account Takeover in Keycloak Account REST APICVE-2026-3911Loworg.keycloak:keycloak-services: Keycloak: Information disclosure of disabled user attributes via administrative endpointCVE-2026-2741Lowcom.vaadin:flow-project: Vaadin: Specially crafted ZIP archives can escape the intended extraction directoryCVE-2026-2742Mediumcom.vaadin:flow-server: Vaadin Vulnerable to Authentication Bypass When Accessing the /VAADIN Endpoint Without a Trailing SlashCVE-2026-23907Mediumorg.apache.pdfbox:pdfbox-examples: Apache PDFBox has Path Traversal through PDComplexFileSpecification.getFilename() functionCVE-2026-24713Criticalorg.apache.iotdb:iotdb-core: Apache IoTDB has an Improper Input Validation vulnerabilityCVE-2026-24015Criticalorg.apache.iotdb:iotdb-core: Apache IoTDB has an Insecure Default Configuration VulnerabilityCVE-2026-24281Highorg.apache.zookeeper:zookeeper: Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManagerCVE-2026-24308Highorg.apache.zookeeper:zookeeper: Apache ZooKeeper has improper handling of configuration valuesCVE-2025-11143Loworg.eclipse.jetty:jetty-http: org.eclipse.jetty:jetty-http has different parsing of invalid URIsCVE-2026-22723Mediumorg.cloudfoundry.identity:cloudfoundry-identity-server: Cloudfoundry UAA has logic error in the token revocation endpoint implementationCVE-2026-3009Highorg.keycloak:keycloak-services: Keycloak allows authentication using an Identity Provider (IdP) even after it has been disabled by an administratorCVE-2026-3047Highorg.keycloak:keycloak-broker-saml: Keycloak SAML Broken has Authentication Bypass by Primary WeaknessCVE-2026-1605Highorg.eclipse.jetty:jetty-server: The Eclipse Jetty Server Artifact has a Gzip request memory leak CVE-2026-29000Criticalorg.pac4j:pac4j-jwt: pac4j-jwt: JwtAuthenticator Authentication Bypass via JWE-Wrapped PlainJWTCVE-2026-29062Hightools.jackson.core:jackson-core: jackson-core has Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource ExhaustionCVE-2025-66024Highorg.xwiki.contrib.blog:application-blog-ui: XWiki Blog Application home page vulnerable to Stored XSS via Post TitleCVE-2026-27446Criticalorg.apache.activemq:artemis-server: Apache Artemis and Apache ActiveMQ Artemis are Missing Authentication for Critical FunctionsCVE-2025-66168Mediumorg.apache.activemq:apache-activemq: Apache ActiveMQ is Vulnerable to Integer Overflow or WraparoundCVE-2025-59059Criticalorg.apache.ranger:ranger-plugins-common: Apache Ranger has a Code Injection vulnerabilityCVE-2025-59060Mediumorg.apache.ranger:ranger-nifi-registry-plugin: Apache Ranger Vulnerable to Improper Validation of Certificate with Host MismatchCVE-2026-28338Mediumnet.sourceforge.pmd:pmd-core: PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messagesCVE-2026-18401Mediumtools.jackson.core:jackson-core: jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS ConditionCVE-2026-28208Mediumcom.github.junrar:junrar: Junrar has an arbitrary file write due to backslash Path Traversal bypass in LocalFolderExtractor on Linux/Unix

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo