Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2020-36843Mediumnet.i2p.crypto:eddsa: Ed25519 Signature Malleability in ed25519-java Due to Missing Scalar Range Check CVE-2025-27017Mediumorg.apache.nifi:nifi-mongodb-services: Apache NiFi: Potential Insertion of MongoDB Password in Provenance Record CVE-2025-27867Mediumorg.apache.felix:org.apache.felix.http.webconsoleplugin: Apache Felix HTTP Webconsole Plugin: XSS in HTTP Webconsole Plugin CVE-2025-2240Highio.smallrye:smallrye-fault-tolerance-core: SmallRye Fault Tolerance out-of-memory (OOM) issue CVE-2025-29891Mediumorg.apache.camel:camel-support: Apache Camel Message Header Injection through request parameters CVE-2025-1391Mediumorg.keycloak:keycloak-services: Improper Authorization in Keycloak Organization Mapper Allows Unauthorized Organization Claims CVE-2025-0604Mediumorg.keycloak:keycloak-ldap-federation: Authentication Bypass Due to Missing LDAP Bind After Password Reset in Keycloak CVE-2025-24813Criticalorg.apache.tomcat:tomcat-catalina: Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT GHSA-47QW-CCJM-9C2CMediumio.github.robothy:local-s3-rest: LocalS3 XML Parser Vulnerable to XML External Entity (XXE) Injection GHSA-V232-254C-M6P7Mediumio.github.robothy:local-s3-rest: LocalS3 Project Vulnerable to XML External Entity (XXE) Injection via Bucket Tagging API GHSA-2466-4485-4PXJMediumio.github.robothy:local-s3-rest: LocalS3 Project Bucket Operations Vulnerable to XML External Entity (XXE) Injection CVE-2025-27136Mediumio.github.robothy:local-s3-rest: LocalS3 CreateBucketConfiguration Endpoint XML External Entity (XXE) Injection CVE-2025-27636Mediumorg.apache.camel:camel-support: Apache Camel: Camel Message Header Injection via Improper Filtering CVE-2025-27604Highcom.xwiki.confluencepro:application-confluence-migrator-pro-ui: com.xwiki.confluencepro:application-confluence-migrator-pro-ui's application homepage is public CVE-2025-27603Criticalcom.xwiki.confluencepro:application-confluence-migrator-pro-ui: com.xwiki.confluencepro:application-confluence-migrator-pro-ui Remote Code Execution via unescaped translations CVE-2025-27625Mediumorg.jenkins-ci.main:jenkins-core: Jenkins Open Redirect vulnerability CVE-2025-27624Mediumorg.jenkins-ci.main:jenkins-core: Jenkins cross-site request forgery (CSRF) vulnerability CVE-2025-27623Mediumorg.jenkins-ci.main:jenkins-core: Jenkins reveals encrypted values of secrets stored in agent configuration to users with Agent/Extended Read permission CVE-2025-27622Mediumorg.jenkins-ci.main:jenkins-core: Jenkins reveals encrypted values of secrets stored in agent configuration to users with Agent/Extended Read permission CVE-2025-27508Highgov.nsa.emissary:emissary: Emissary May Use a Broken or Risky Cryptographic Algorithm CVE-2025-27497Highorg.openidentityplatform.opendj:opendj-server-legacy: OpenDJ Denial of Service (DoS) using alias loop CVE-2023-38693Criticalorg.lucee:lucee: Lucee RCE/XXE Vulnerability CVE-2024-55532Loworg.apache.ranger:security-admin-web: Apache Ranger Improper Neutralization of Formula Elements vulnerability CVE-2024-24778Mediumorg.apache.streampipes:streampipes-parent: Apache StreamPipes has improper privilege management in a REST interface CVE-2025-1686Highio.pebbletemplates:pebble: Pebble has Arbitrary Local File Inclusion (LFI) Vulnerability via `include` macro

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.