Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-62259Mediumcom.liferay.portal:release.portal.bom: Liferay Portal Does Not Limit Access to APIs Before Email Verification CVE-2025-62261Mediumcom.liferay.portal:release.portal.bom: Liferay Portal Stores Password Reset Tokens in Plain Text CVE-2025-62262Mediumcom.liferay:com.liferay.portal.security.ldap.impl: Liferay Portal Vulnerable to Information Exposure Through a Log File Vulnerability in LDAP Import Feature CVE-2025-62263Mediumcom.liferay:com.liferay.account.admin.web: Liferay Portal Vulnerable to Cross-Site Scripting CVE-2025-62253Mediumcom.liferay:com.liferay.layout.admin.web: Liferay Portal Vulnerable to Open Redirect via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter CVE-2025-11419Highorg.keycloak:keycloak-quarkus-dist: Keycloak TLS Client-Initiated Renegotiation Denial of Service CVE-2025-62782Mediumde.themoep:inventorygui: InventoryGui allows item duplication with experimental "Bundle" item in GUIs which use GuiStorageElement CVE-2025-62783Mediumde.themoep:inventorygui: InventoryGui affected by item duplication in GUIs which use GuiStorageElement CVE-2025-55754Loworg.apache.tomcat:tomcat: Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences CVE-2025-61795Loworg.apache.tomcat:tomcat: Apache Tomcat Vulnerable to Improper Resource Shutdown or Release CVE-2025-55752Highorg.apache.tomcat:tomcat: Apache Tomcat Vulnerable to Relative Path Traversal CVE-2025-12194Mediumorg.bouncycastle:bc-fips: Bouncy Castle Vulnerable to Uncontrolled Resource Consumption CVE-2025-62254Mediumcom.liferay.portal:com.liferay.portal.impl: Liferay Portal ComboServlet denial of service via large file combination CVE-2025-62255Lowcom.liferay:com.liferay.knowledge.base.web: Liferay Portal Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page CVE-2025-60837Mediumnet.mingsoft:ms-mcms: MCMS reflected cross-site scripting (XSS) vulnerability CVE-2025-12110Mediumorg.keycloak:keycloak-services: Keycloak does not invalidate offline sessions when the offline_access scope is removed CVE-2025-62256Mediumcom.liferay:com.liferay.portal.security.auth.verifier: Liferay Portal and DXP do not properly restrict access to OpenAPI CVE-2025-11429Mediumorg.keycloak:keycloak-services: Keycloak does not invalidate sessions when "Remember Me" is disabled CVE-2025-62247Lowcom.liferay:com.liferay.search.experiences.service: Liferay Portal and DXP are Missing Authorization in Collection Provider CVE-2025-62248Mediumcom.liferay:com.liferay.dynamic.data.mapping.web: Liferay Portal and Liferay DXP vulnerable to reflected cross-site scripting (XSS)CVE-2025-62710Mediumorg.sakaiproject.kernel:sakai-kernel-impl: Sakai kernel-impl: predictable PRNG used to generate server‑side encryption key in EncryptionUtilityServiceImpl CVE-2025-11966Lowio.vertx:vertx-web: Vert.x-Web vulnerable to Stored Cross-site Scripting in directory listings via file names CVE-2025-11965Mediumio.vertx:vertx-web: Vert.x-Web Access Control Flaw in StaticHandler’s Hidden File Protection for Files Under Hidden Directories CVE-2025-62249Mediumcom.liferay.portal:com.liferay.portal.impl: Liferay Portal reflected cross-site scripting (XSS) vulnerability in the google_gaget CVE-2025-62250Mediumcom.liferay:com.liferay.portal.cluster.multiple: Liferay Portal fails to verify messages from the cluster network is trusted

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo