Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2025-53506Highorg.apache.tomcat:tomcat-coyote: Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streamsCVE-2025-52520Highorg.apache.tomcat:tomcat-catalina: Apache Tomcat Catalina is vulnerable to DoS attack through bypassing of size limitsCVE-2025-52434Mediumorg.apache.tomcat:tomcat-coyote: Apache Tomcat is vulnerable to resource exhaustion when using the APR/Native connectorCVE-2025-53742Mediumorg.jenkins-ci.plugins:applitools-eyes: Jenkins Applitools Eyes Plugin vulnerability exposes unencrypted keys to certain authenticated usersCVE-2025-53743Mediumorg.jenkins-ci.plugins:applitools-eyes: Jenkins Applitools Eyes Plugin vulnerability does not mask API keys on its job configuration formCVE-2025-53676Mediumio.jenkins.plugins:xooa: Jenkins Xooa Plugin vulnerability exposes unencrypted tokens to authenticated usersCVE-2025-53678Lowio.jenkins.plugins:user1st-utester: Jenkins User1st uTester Plugin vulnerability exposes unencrypted token to authenticated usersCVE-2025-53675Mediumorg.jenkins-ci.plugins:warrior: Jenkins Warrior Framework Plugin vulnerability exposes unencrypted passwords to certain authenticated usersCVE-2025-53677Mediumio.jenkins.plugins:xooa: Jenkins Xooa Plugin vulnerability does not mask its Xooa Deployment TokenCVE-2025-53669Mediumorg.jenkins-ci.plugins:vaddy-plugin: Jenkins VAddy Plugin vulnerability exposes plaintext keys on its job configuration formCVE-2025-53672Mediumio.jenkins.plugins:kryptowire: Jenkins Kryptowire Plugin vulnerability stores unencrypted Kryptowire API keyCVE-2025-53671Mediumorg.jenkins-ci.plugins:nouvola-divecloud: Jenkins Nouvola DiveCloud Plugin vulnerability does not mask keys on its job configuration formCVE-2025-53673Mediumorg.jenkins-ci.plugins:sensedia-api-platform: Jenkins Sensedia API Platform Plugin vulnerability exposes unencrypted tokens in its global configuration fileCVE-2025-53668Mediumorg.jenkins-ci.plugins:vaddy-plugin: Jenkins VAddy Plugin vulnerability exposes unencrypted keys to certain authenticated usersCVE-2025-53674Mediumorg.jenkins-ci.plugins:sensedia-api-platform: Jenkins Sensedia API Platform Plugin vulnerability exposes unencrypted tokensCVE-2025-53661Lowio.jenkins.plugins:testsigma: Jenkins Testsigma Test Plan vulnerability exposes API keys via job configuration formCVE-2025-53659Mediumorg.jenkins-ci.plugins:qmetry-test-management: Jenkins QMetry Test Management Plugin stores unencrypted API keysCVE-2025-53662Mediumorg.jenkins-ci.plugins:ifttt-build-notifier: Jenkins IFTTT Build Notifier Plugin vulnerability exposes IFTTT Maker Channel KeysCVE-2025-53660Mediumorg.jenkins-ci.plugins:qmetry-test-management: Jenkins QMetry Test Management Plugin vulnerability exposes API keysCVE-2025-53667Mediumorg.jenkins-ci.plugins:deadmanssnitch: Jenkins Dead Man's Snitch Plugin vulnerability does not mask tokensCVE-2025-53670Mediumorg.jenkins-ci.plugins:nouvola-divecloud: Jenkins Nouvola DiveCloud Plugin vulnerability stores unencrypted credentialsCVE-2025-53657Mediumorg.jenkins-ci.plugins:soapui-pro-functional-testing: Jenkins ReadyAPI Functional Testing Plugin vulnerability exposes secretsCVE-2025-53663Mediumcom.ibm.devops:ibm-cloud-devops: Jenkins IBM Cloud DevOps Plugin vulnerability exposes SonarQube authentication tokensCVE-2025-53658Highorg.jenkins-ci.plugins:applitools-eyes: Jenkins Applitools Eyes Plugin vulnerable to XSS through its Build pageCVE-2025-53664Mediumcom.apica:ApicaLoadtest: Jenkins Apica Loadtest Plugin vulnerability exposes authentication tokens

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo