Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-9467Mediumcom.vaadin:vaadin-server: Vaadin Framework possible file bypass via upload validation on the server-side CVE-2025-43772Highcom.liferay:com.liferay.portal.workflow.kaleo.forms.web: Liferay Portal Vulnerable to Denial of Service in Kaleo Forms Admin CVE-2025-58057Mediumio.netty:netty-codec-compression: Netty's decoders vulnerable to DoS via zip bomb style attack CVE-2025-55748Criticalorg.xwiki.platform:xwiki-platform-skin-skinx: XWiki configuration files can be accessed through jsx and sx endpoints CVE-2025-55747Criticalorg.xwiki.platform:xwiki-platform-webjars-api: XWiki configuration files can be accessed through the webjars API CVE-2025-58460Mediumio.jenkins.plugins:opentelemetry: Jenkins OpenTelemetry Plugin missing permission check allows capturing credentials CVE-2025-58458Mediumorg.jenkins-ci.plugins:git-client: Jenkins Git client Plugin file system information disclosure vulnerability CVE-2025-58459Mediumorg.jenkins-ci.plugins:global-build-stats: Jenkins global-build-stats Plugin missing permission check can result in graph IDs being enumerated CVE-2024-43166Loworg.apache.dolphinscheduler:dolphinscheduler: Apache DolphinScheduler Incorrect Default Permissions Vulnerability CVE-2025-9784Highio.undertow:undertow-core: Undertow MadeYouReset HTTP/2 DDoS Vulnerability CVE-2025-46047Mediumorg.silverpeas.core:silverpeas-core: Silverpeas Core Username Enumeration Vulnerability CVE-2025-43773Mediumcom.liferay:com.liferay.portal.workflow.kaleo.runtime.impl: Liferay Portal allows improper access through the expandoTableLocalService CVE-2025-55202Loworg.opencastproject:opencast-user-interface-configuration: Opencast has a partial path traversal vulnerability in UI config CVE-2025-58059Criticalcom.ritense.valtimo:core: Valtimo scripting engine can be used to gain access to sensitive data or resources CVE-2025-58049Mediumorg.xwiki.platform:xwiki-platform-export-pdf-api: XWiki PDF export jobs store sensitive cookies unencrypted in job statuses CVE-2025-26467Highorg.apache.cassandra:cassandra-all: Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions (4.0.16 only)CVE-2025-43766Mediumcom.liferay:com.liferay.style.book.web: Liferay Portal allows unrestricted upload of file in the style books component CVE-2025-43765Mediumcom.liferay:com.liferay.journal.service: Liferay Portal stored cross-site scripting in text field of the web content structure CVE-2025-43764Mediumcom.liferay:com.liferay.portal.workflow.kaleo.designer.web: Liferay Portal ReDoS with Role Name search in KaleoDesignerPortlet CVE-2025-43767Mediumcom.liferay:com.liferay.info.impl: Liferay Portal allows open redirect in /c/portal/edit_info_item parameter redirect CVE-2025-43769Mediumcom.liferay:com.liferay.plugins.admin.web: Liferay Portal vulnerable to Stored XSS in Components portlet CVE-2025-43768Mediumcom.liferay.portal:com.liferay.portal.impl: Liferay Portal JSONWS API endpoint shares sensitive information CVE-2025-43770Mediumcom.liferay.portal:com.liferay.portal.kernel: Liferay Portal vulnerable to Reflected XSS with the referer and forward parameter CVE-2025-43761Mediumcom.liferay:com.liferay.frontend.editor.ckeditor.web: Liferay Portal Reflected XSS in CKeditor 4.21.0 endpoint CVE-2025-43759Mediumcom.liferay:com.liferay.layout.impl: Liferay Portal users are able to add system admin portlets to pages

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo