Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-63490Highcom.github.jknack:handlebars-springmvc: Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypassCVE-2026-32773Mediumpyspark: Apache Spark History Server allows stored cross-site scripting through unescaped application namesCVE-2026-84218Highorg.jolokia:jolokia-service-jsr160: jolokia-service-jsr160 Incomplete target JMX Service URL deny list handling for user-controlled inputCVE-2026-55860Mediumorg.mariadb:r2dbc-mariadb: org.mariadb:r2dbc-mariadb vulnerable to cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a…CVE-2026-55859Mediumorg.mariadb:r2dbc-mariadb: org.mariadb:r2dbc-mariadb has Inappropriate Encoding for Output Context and Improper Encoding or Escaping of OutputCVE-2026-55858Mediumorg.mariadb.jdbc:mariadb-java-client: org.mariadb.jdbc:mariadb-java-client has Inappropriate Encoding for Output ContextCVE-2026-55857Mediumorg.mariadb.jdbc:mariadb-java-client: org.mariadb.jdbc:mariadb-java-client has Cleartext Transmission of Sensitive Information and Insufficiently Protected CredentialsCVE-2026-55856Mediumorg.mariadb.jdbc:mariadb-java-client: MariaDB has cleartext password disclosure to a MITM on the initial-handshakeCVE-2026-55848Highorg.mapfish.print:print-lib: MapFish Print has XXE that allows reading arbitrary files of certain typesCVE-2026-55867Mediumorg.graylog2:graylog2-server: Graylog token revocation endpoint allows authenticated users to delete other users’ access tokensCVE-2026-55841Highorg.graylog2:graylog2-server: Fortigate syslog message parser can be exploited to modify or delete fields from the original messageCVE-2026-55673Highcom.powsybl:powsybl-computation-local: PowSyBl Core has Command Injection in LocalCommandExecutor-sCVE-2026-55175Highio.spinnaker.rosco:rosco-manifests: Spinnaker: Improper yaml processing on kustomize bake operationsCVE-2026-55425Mediumorg.graylog2:graylog2-server: Graylog Server: System Catalog titles endpoint can be used to retrieve values of protected database fieldsCVE-2026-55566Mediumorg.yamcs:yamcs-core: Yamcs has DOM XSS in Extension RoutingCVE-2026-55565Criticalorg.yamcs:yamcs-core: Yamcs vulnerable to authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)CVE-2026-55559Criticalorg.yamcs:yamcs-core: Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance)CVE-2026-55552Highorg.yamcs:yamcs-core: Yamcs has Unauthenticated Directory TraversalCVE-2026-55549Mediumorg.yamcs:yamcs-core: Yamcs has Reflected XSS in the URL of the Authorize EndpointCVE-2026-55548Mediumorg.yamcs:yamcs-core: Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packetsCVE-2026-55547Mediumorg.yamcs:yamcs-core: Yamcs's Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security…CVE-2026-55545Mediumorg.yamcs:yamcs-core: Yamcs's WebSocket subscription handlers omit the privilege checks their REST siblings enforceCVE-2026-55521Highorg.yamcs:yamcs-core: Yamcs Core API has Multiple Missing Function Level Access Control vulnerabilitiesCVE-2026-55511Criticalorg.yamcs:yamcs-core: Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`CVE-2026-47890Criticalorg.springframework:spring-webflux: Spring Framework Server Sent Event stream corruption while rendering fragments

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo