Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-J6HM-V3X2-QV6JLowland.oras:oras-java-sdk: land.oras:oras-java-sdk: Symlink-based path traversal in ArchiveUtils.untar / unzip allows arbitrary file write outside extraction directoryCVE-2026-49989Lowio.crate:crate: CrateDB's Blob HTTP handler bypasses authorizationCVE-2026-46487Highorg.geonetwork-opensource:geonetwork: GeoNetwork has ACL bypass on Elasticsearch search when request body omits query fieldCVE-2026-39379Highorg.geonetwork-opensource:geonetwork: GeoNetwork has reflected XSS through client-side template injectionCVE-2026-48791Lowdev.sigstore:sigstore-java: Sigstore Java has a vulnerability with bundle verification of integratedTimeCVE-2026-48717Mediumorg.openidentityplatform.openam:openam-oauth2: OpenAM OAuth Authorization Bypass via PKCE ChallengeCVE-2026-47426Highorg.openidentityplatform.openam:openam-oauth2: OpenAM OAuth Client Impersonation via JWKS Resolver CacheCVE-2026-47424Highorg.openidentityplatform.openam:openam-scripting: OpenAM Authenticated RCE via Groovy Sandbox EscapeCVE-2026-46623Highorg.openidentityplatform.openam:openam-auth-oauth2: OpenAM Account Takeover via Unverified Password Change in OAuth2 ModuleCVE-2026-46619Highorg.openidentityplatform.openam:openam-auth-msisdn: OpenAM Authentication Bypass via MSISDN LDAP InjectionCVE-2026-48722Mediumio.nextflow:nextflow: nextflow auth login command has incorrect default permissionsCVE-2026-46560Highorg.openidentityplatform.openam:openam-radius: OpenAM: Unauthenticated Authentication Bypass via RADIUS SpoofingCVE-2026-46498Highorg.openidentityplatform.openam:openam-oauth2: OpenAM Arbitrary OAuth Token Minting via Push RegistrationCVE-2026-45794Highorg.openidentityplatform.openam:openam-push-notification: OpenAM has Unsafe Java Deserialization via SNSCVE-2026-45052Criticalorg.openidentityplatform.openam:openam-federation-library: OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery EndpointsCVE-2026-45051Criticalorg.openidentityplatform.openam:openam-auth-webauthn: OpenAM: Pre-auth RCE via Java Deserialization in WebAuthn Authenticator StorageCVE-2026-48480Mediumio.netty.incubator:netty-incubator-codec-ohttp: OHttpVersionChunkDraft: Missing Final-Chunk Enforcement Leads to Undetected Stream TruncationCVE-2026-54517Mediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind has @JsonView bypass for setterless creator propertiesCVE-2026-54516Mediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fieldsCVE-2026-54515Mediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnorePropertiesCVE-2026-54514Mediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)CVE-2026-54513Highcom.fasterxml.jackson.core:jackson-databind: jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)CVE-2026-54512Highcom.fasterxml.jackson.core:jackson-databind: jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiationCVE-2026-50193Mediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()CVE-2026-54518Mediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind has a @JsonView bypass for unwrapped creator parameters

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo