Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-27533Mediumorg.apache.activemq:activemq-openwire-legacy: Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation CVE-2025-2901Mediumorg.jboss.hal:hal-console: HAL Cross Site Scripting (XSS) vulnerability of user input when storing it in a data store CVE-2025-4388Mediumcom.liferay:com.liferay.marketplace.app.manager.web: Liferay Portal Reflected XSS in marketplace-app-manager-web CVE-2025-46762Highorg.apache.parquet:parquet-avro: Apache Parquet Java: Potential malicious code execution from trusted packages in the parquet-avro module when reading an Avro schema from a…CVE-2025-45616Criticalcom.baidu.mapp:brcc-core: BRCC Incorrect Access Control vulnerability CVE-2025-2905Criticalorg.wso2.am:am-distribution-parent: WSO2 API Manager XML External Entity (XXE) vulnerability CVE-2024-52979Mediumorg.elasticsearch:elasticsearch: Elasticsearch Uncontrolled Resource Consumption Vulnerability CVE-2025-3910Mediumorg.keycloak:keycloak-services: Keycloak vulnerable to two factor authentication bypass CVE-2025-3501Highorg.keycloak:keycloak-services: Keycloak hostname verification CVE-2025-46558Criticalorg.xwiki.contrib.markdown:syntax-markdown-commonmark12: org.xwiki.contrib.markdown:syntax-markdown-commonmark12 vulnerable to XSS via Markdown content CVE-2025-46557Highorg.xwiki.platform:xwiki-platform-security-authentication-ui: Any user with view access to the XWiki space can change the authenticator CVE-2025-46554Mediumorg.xwiki.platform:xwiki-platform-rest-server: XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API CVE-2025-32974Criticalorg.xwiki.platform:xwiki-platform-security-requiredrights-default: org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content…CVE-2025-32973Criticalorg.xwiki.platform:xwiki-platform-component-wiki: org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right CVE-2025-32972Loworg.xwiki.platform:xwiki-platform-lesscss-script: The lesscss script service allows cache clearing without programming right CVE-2025-32971Loworg.xwiki.platform:xwiki-platform-search-solr-api: Solr script service doesn't take dropped programming right into account CVE-2025-32970Mediumorg.xwiki.platform:xwiki-platform-wysiwyg-api: org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerability CVE-2025-31651Loworg.apache.tomcat:tomcat-catalina: Apache Tomcat Rewrite rule bypass CVE-2025-31650Mediumorg.apache.tomcat:tomcat-coyote: Apache Tomcat Denial of Service via invalid HTTP priority header CVE-2025-22235Highorg.springframework.boot:spring-boot: Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed CVE-2025-3985Mediumorg.apereo.cas:cas-management-webapp-support: Apereo CAS has inefficient regular expression complexity CVE-2025-3986Mediumorg.apereo.cas:cas-server-core-configuration-metadata-repository: Apereo CAS has inefficient regular expression complexity CVE-2025-3984Loworg.apereo.cas:cas-management-webapp-support: Apereo CAS code injection vulnerability CVE-2025-27820Highorg.apache.httpcomponents.client5:httpclient5: Apache HttpClient disables domain checks CVE-2025-32969Criticalorg.xwiki.platform:xwiki-platform-rest-server: org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo