Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-62237Mediumcom.liferay.commerce:com.liferay.commerce.order.web: Liferay Portal Commerce is vulnerable to XSS through account "name" field CVE-2025-62238Mediumcom.liferay:com.liferay.account.admin.web: Liferay Portal's Membership page is vulnerable to XSS through “name“ text field CVE-2025-62239Mediumcom.liferay:com.liferay.portal.workflow.kaleo.designer.web: Liferay Portal is vulnerable to XSS through its workflow process builder CVE-2025-37727Mediumorg.elasticsearch.plugin:reindex-client: Elasticsearch: Insertion of Sensitive Information into Log File via reindex API CVE-2025-30001Highorg.apache.streampark:streampark: Apache StreamPark contains an Incorrect Execution-Assigned Permissions vulnerability CVE-2025-62240Mediumcom.liferay:com.liferay.calendar.web: Liferay Portal is vulnerable to XSS through its Calendar Events parameters CVE-2025-62228Mediumorg.apache.flink:flink-cdc-pipeline-connectors: Apache Flink CDC is vulnerable to SQL Injection through maliciously crafted identifiers CVE-2025-9162Mediumorg.keycloak:keycloak-model-storage-services: Keycloak Potential Variable Reference in Model Storage Services CVE-2025-61788Mediumorg.opencastproject:opencast-common: Opencast's Paella Player 7 is vulnerable to Cross-Site Scripting CVE-2025-43771Mediumcom.liferay:com.liferay.flags.web: Liferay Portal Notifications Widget has multiple XSS vulnerabilities through various text fields CVE-2025-43830Mediumcom.liferay.portal:release.portal.bom: Liferay Portal is vulnerable to Stored XSS through Forms text type field CVE-2025-43829Mediumcom.liferay.commerce:com.liferay.commerce.shop.by.diagram.web: Liferay Portal Commerce Shop is vulnerable to Stored XSS through SVG file CVE-2025-43821Mediumcom.liferay.commerce:com.liferay.commerce.product.service: Liferay Portal is vulnerable to XSS through its Commerce Product's Name text field CVE-2025-43823Mediumcom.liferay.portal:release.portal.bom: Liferay Portal is vulnerable to XSS through its Commerce Search Result widget CVE-2025-43822Mediumcom.liferay.portal:release.portal.bom: Liferay Portal has multiple Stored XSS vulnerabilities on its View Order page CVE-2025-43824Mediumcom.liferay.portal:release.portal.bom: Liferay Profile Widget does not prevent vCard extension spoofing CVE-2025-52472Criticalorg.xwiki.platform:xwiki-platform-rest-server: XWiki Platform is vulnerable to HQL injection via wiki and space search REST API CVE-2025-49594Criticalorg.xwiki.contrib.oidc:oidc-authenticator: XWiki OIDC Authenticator: Users with "view" access can create tokens for any users they can view CVE-2025-43825Mediumcom.liferay:com.liferay.portal.template.freemarker: Liferay Portal exposes sensitive user data through its Freemarker template CVE-2025-61733Highorg.apache.kylin:kylin: Apache Kylin Authentication Bypass Vulnerability CVE-2025-61735Highorg.apache.kylin:kylin: Apache Kylin Server-Side Request Forgery (SSRF) Vulnerability CVE-2025-61734Highorg.apache.kylin:kylin: Apache Kylin Files or Directories Accessible to External Parties CVE-2025-11226Mediumch.qos.logback:logback-core: QOS.CH logback-core is vulnerable to Arbitrary Code Execution through file processing CVE-2025-43826Mediumcom.liferay.portal:release.portal.bom: Liferay Portal Vulnerable to XSS in Web Content translation CVE-2025-43827Mediumcom.liferay:com.liferay.portal.security.audit.web: Liferay Portal Vulnerable to IDOR via audit events

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.