Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-2622Mediumcom.aizuda:snail-job: aizuda snail-job Vulnerable to Deserialization via `nodeExpression` Argument CVE-2025-26796Mediumorg.apache.oozie:oozie-core: Apache Oozie Cross-Site Scripting (XSS)CVE-2025-2565Mediumcom.liferay.portal:release.portal.bom: Liferay Portal and Liferay DXP Reveals Data via Forms CVE-2025-27888Mediumorg.apache.druid:druid: Apache Druid vulnerable to Server-Side Request Forgery, Cross-site Scripting, Open Redirect CVE-2024-8616Highh2o: H2O Vulnerable to Arbitrary File Overwrite CVE-2024-8062Highh2o: H2O Vulnerable to Denial of Service (DoS) via `HEAD` Request CVE-2024-7765Highh2o: H2O Vulnerable to Denial of Service (DoS) via Large GZIP Parsing CVE-2024-7768Highh2o: H2O Vulnerable to Denial of Service (DoS) via `/3/ImportFiles` Endpoint CVE-2024-6854Highh2o: H2O Vulnerable to Arbitrary File Overwrite via File Export CVE-2024-6863Mediumh2o: H2O Vulnerable to Execution of Arbitrary Files CVE-2024-10550Highh2o: H2O Vulnerable to Denial of Service (DoS) via `/3/ParseSetup` Endpoint CVE-2024-10553Criticalh2o: H2O Deserialization of Untrusted Data Vulnerability CVE-2024-10572Highh2o: H2O Vulnerable to Denial of Service (DoS) and File Write CVE-2024-10549Highh2o: H2O Vulnerable to Denial of Service (DoS) via `/3/Parse` Endpoint CVE-2024-54016Loworg.apache.seata:seata-parent: Apache Seata Vulnerable to Data Amplification CVE-2024-47552Loworg.apache.seata:seata-config-core: Apache Seata Vulnerable to Deserialization of Untrusted Data CVE-2025-22228Highorg.springframework.security:spring-security-crypto: Spring Security Does Not Enforce Password Length CVE-2025-2536Mediumcom.liferay.portal:release.dxp.bom: Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS)CVE-2025-29926Highorg.xwiki.platform:xwiki-platform-wiki-rest-default: The WikiManager REST API allows any user to create wikis CVE-2025-29925Highorg.xwiki.platform:xwiki-platform-rest-server: XWiki allows unregistered users to access private pages information through REST endpoint CVE-2025-29924Highorg.xwiki.platform:xwiki-platform-security-authorization-api: XWiki uses the wrong wiki reference in AuthorizationManager CVE-2025-30197Lowio.jenkins.plugins:zohoqengine: Jenkins Zoho QEngine Plugin Displays Unmasked API Keys CVE-2025-30196Highorg.jenkins-ci.plugins:anchorchain: Jenkins AnchorChain Plugin Has a Cross-Site Scripting (XSS) Vulnerability CVE-2024-58103Mediumcom.squareup.wire:wire-runtime: Wire has Uncontrolled Recursion on Nested Groups CVE-2025-27496Lownet.snowflake:snowflake-jdbc: Snowflake JDBC Driver client-side encryption key in DEBUG logs

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo