Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-62257Mediumcom.liferay.portal:release.portal.bom: Liferay Portal vulnerable to password enumeration CVE-2025-64148Mediumorg.jenkins-ci.plugins:publish-to-bitbucket: Jenkins Publish to Bitbucket Plugin is missing a permissions check CVE-2025-64150Mediumorg.jenkins-ci.plugins:publish-to-bitbucket: Jenkins Publish to Bitbucket Plugin is missing a permissions check CVE-2025-64149Mediumorg.jenkins-ci.plugins:publish-to-bitbucket: Jenkins Publish to Bitbucket Plugin vulnerable to CSRF and missing permissions check CVE-2025-64147Mediumorg.jenkins-ci.plugins:curseforge-publisher: Jenkins Curseforge Publisher Plugin does not mask API Keys displayed on the job configuration form CVE-2025-64135Mediumio.jenkins.plugins:eggplant-runner: Jenkins Eggplant Runner Plugin protection mechanism disabled CVE-2025-64133Mediumjp.ikedam.jenkins.plugins:extensible-choice-parameter: Jenkins Extensible Choice Parameter Plugin vulnerable to cross-site request forgery CVE-2025-64137Mediumorg.jenkins-ci.plugins:themis: Jenkins Themis Plugin is missing a permission check CVE-2025-64132Mediumio.jenkins.plugins:mcp-server: Jenkins MCP Server Plugin does not perform permission checks in multiple MCP tools CVE-2025-64136Mediumorg.jenkins-ci.plugins:themis: Jenkins Themis Plugin vulnerable to cross-site request forgery CVE-2025-64140Highorg.jenkins-ci.plugins:azure-cli: Jenkins Azure CLI Plugin does not restrict the commands it executes CVE-2025-64139Mediumorg.jenkins-ci.plugins:windocks-start-container: Jenkins Start Windocks Containers Plugin is missing a permission check CVE-2025-64134Highorg.jenkins-ci.plugins:jdepend: Jenkins JDepend Plugin vulnerable to XML external entity attacks CVE-2025-64145Mediumio.jenkins.plugins:byteguard-build-actions: Jenkins ByteGuard Build Actions Plugin does not mask API tokens displayed on the job configuration form CVE-2025-64143Mediumcom.openshift.jenkins:openshift-pipeline: Jenkins OpenShift Pipeline Plugin stores authorization tokens unencrypted in job config.xml files CVE-2025-64142Mediumorg.jenkins-ci.plugins:nexus-task-runner: Jenkins Nexus Task Runner Plugin is missing a permission check CVE-2025-64141Mediumorg.jenkins-ci.plugins:nexus-task-runner: Jenkins Nexus Task Runner Plugin vulnerable to cross-site request forgery CVE-2025-64146Mediumorg.jenkins-ci.plugins:curseforge-publisher: Jenkins Curseforge Publisher Plugin stores API Keys unencrypted in job config.xml files CVE-2025-64138Mediumorg.jenkins-ci.plugins:windocks-start-container: Jenkins Start Windocks Containers Plugin vulnerable to cross-site request forgery CVE-2025-64131Highorg.jenkins-ci.plugins:saml: Jenkins SAML Plugin does not implement a replay cache CVE-2025-64144Mediumio.jenkins.plugins:byteguard-build-actions: Jenkins ByteGuard Build Actions Plugin stores API tokens unencrypted in job config.xml files CVE-2025-62784Mediumde.themoep:inventorygui: InventoryGui allows item duplication in GUIs which use GuiStorageElement CVE-2025-12390Mediumorg.keycloak:keycloak-services: Keycloak vulnerable to session takeovers due to reuse of session identifiers CVE-2025-62258Highcom.liferay.portal:release.portal.bom: Liferay Portal Vulnerable to CSRF in Headless APIs CVE-2025-62260Highcom.liferay.portal:release.portal.bom: Liferay Portal Vulnerable to DoS via Crafted Headless API Request

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo