Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2024-2321Mediumorg.wso2.am:am-parent: WSO2 incorrect authorization vulnerability CVE-2025-1634Highio.quarkus:quarkus-resteasy: io.quarkus:quarkus-resteasy: Memory Leak in Quarkus RESTEasy Classic When Client Requests Timeout CVE-2025-1584Mediumorg.noear:solon-web-staticfiles: Solon Path Traversal CVE-2025-24893Criticalorg.xwiki.platform:xwiki-platform-search-solr-ui: XWiki Platform allows remote code execution as guest via SolrSearchMacros request CVE-2025-23020Mediumtech.kwik:kwik: Kwik hash collision vulnerability CVE-2024-4028Loworg.keycloak:keycloak-core: Keycloak allows cross-site scripting (XSS)CVE-2024-56180Criticalorg.apache.eventmesh:eventmesh-meta-raft: Apache EventMesh: raft Hessian Deserialization Vulnerability allowing remote code execution CVE-2024-52577Criticalorg.apache.ignite:ignite-core: Apache Ignite: Possible RCE when deserializing incoming messages by the server node CVE-2025-26511Highcom.instaclustr:cassandra-lucene-index-plugin: Instaclustr Cassandra-Lucene-Index allows bypass of Cassandra RBAC CVE-2025-1247Highio.quarkus:quarkus-rest: Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance CVE-2024-46910Mediumorg.apache.atlas:apache-atlas: Apache Atlas: An authenticated user can perform XSS and potentially impersonate another user CVE-2024-32037Mediumorg.geonetwork-opensource:gn-services: GeoNetwork search end-point information disclosure in response headers CVE-2024-52067Mediumorg.apache.nifi:nifi-framework-core: Apache NiFi: Potential Insertion of Sensitive Parameter Values in Debug Log CVE-2025-25193Mediumio.netty:netty-common: Denial of Service attack on windows app using Netty CVE-2025-24970Highio.netty:netty-handler: SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine CVE-2025-25247Mediumorg.apache.felix:org.apache.felix.webconsole: Apache Felix Webconsole: XSS in services console CVE-2024-57606Highorg.jeecgframework.boot:jeecg-boot-common: SQL injection in JeecgBoot CVE-2024-45626Highorg.apache.james:james-server-jmap-draft: Apache James vulnerable to denial of service through JMAP HTML to text conversion CVE-2024-37358Highorg.apache.james.protocols:protocols-imap: Apache James vulnerable to denial of service through the use of IMAP literals CVE-2024-57699Highnet.minidev:json-smart: Netplex Json-smart Uncontrolled Recursion vulnerability CVE-2024-10973Mediumorg.keycloak:keycloak-quarkus-server: Keycloak on Quarkus CLI option for encrypted JGroups ignored CVE-2024-36404Criticalorg.geotools:gt-app-schema: GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions CVE-2025-24860Mediumorg.apache.cassandra:cassandra-all: Apache Cassandra: CassandraNetworkAuthorizer and CassandraCIDRAuthorizer can be bypassed allowing access to different network regions CVE-2024-27137Mediumorg.apache.cassandra:cassandra-all: Apache Cassandra: unrestricted deserialization of JMX authentication credentials CVE-2025-23015Highorg.apache.cassandra:cassandra-all: Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.