Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-43758Mediumcom.liferay:com.liferay.frontend.js.web: Liferay Portal's unauthenticated users can access loaded files via URL before submitting the object entry CVE-2025-43762Mediumcom.liferay:com.liferay.dynamic.data.mapping.form.web: Liferay Portal users can upload an unlimited amount of files CVE-2025-43760Mediumcom.liferay.portal:release.portal.bom: Liferay Portal Reflected Cross-Site Scripting Vulnerability via PortalUtil.escapeRedirect CVE-2025-43751Mediumcom.liferay:com.liferay.login.web: Liferay Portal User Enumeration Vulnerability via the Create Account Page CVE-2025-51825Mediumorg.jeecgframework.boot:jeecg-boot-base-core: JeecgBoot SQL Injection Vulnerability CVE-2025-9340Loworg.bouncycastle:bc-fips: Bouncy Castle for Java has Out-of-Bounds Write Vulnerability CVE-2025-9341Mediumorg.bouncycastle:bc-fips: Bouncy Castle for Java has Uncontrolled Resource Consumption Vulnerability CVE-2025-43752Mediumcom.liferay.portal:release.portal.bom: Liferay Portal's Unlimited File Upload Could Result in DoS CVE-2025-43753Lowcom.liferay:com.liferay.layout.taglib: Liferay Portal Reflected Cross-Site Scripting Vulnerability via Form Container CVE-2025-51606Highcn.hippo4j:hippo4j-core: hippo4j Includes Hard Coded Secret Key in JWT Creation CVE-2025-43754Mediumcom.liferay.portal:release.portal.bom: Liferay Portal Username Enumeration Vulnerability CVE-2025-43755Mediumcom.liferay:com.liferay.layout.admin.web: Liferay Portal Stored Cross-Site Scripting Vulnerability via GroupPagesPortlet_type Parameter CVE-2025-43756Mediumcom.liferay.portal:release.portal.bom: Liferay Portal Reflected Cross-Site Scripting Vulnerability via snippet Parameter CVE-2025-9264Lowcom.xuxueli:xxl-job-admin: xxl-job Jobs Handler remove function allows improper control of resource identifiers via ID parameter CVE-2025-9263Lowcom.xuxueli:xxl-job-admin: xxl-job Vulnerable to Resource Injection and Authorization Bypass Through User-Controlled Key CVE-2025-54988Criticalorg.apache.tika:tika-parser-pdf-module: Apache Tika XXE Vulnerability via Crafted XFA File Inside a PDF CVE-2025-43746Mediumcom.liferay.portal:release.portal.bom: Liferay Portal Vulnerable to Cross-Site Scripting in Dynamic Data Mapping CVE-2025-43757Mediumcom.liferay.portal:release.portal.bom: Liferay Portal Vulnerable to Cross-Site Scripting via DDMPortlet_definition Parameter CVE-2025-5115Highorg.eclipse.jetty.http2:http2-common: Eclipse Jetty affected by MadeYouReset HTTP/2 vulnerability CVE-2025-43748Highcom.liferay.portal:release.portal.bom: Liferay Portal Vulnerable to Cross-Site Request Forgery CVE-2025-43749Mediumcom.liferay.portal:release.portal.bom: Liferay Portal Unauthenticated File Access via URL CVE-2025-43750Mediumcom.liferay:com.liferay.dynamic.data.mapping.form.web: Liferay Portal Unvalidated File Upload CVE-2025-43741Mediumcom.liferay.portal:release.portal.bom: Liferay Portal Vulnerable to Cross-Site Scripting via assetTagNames Parameter CVE-2025-43742Mediumcom.liferay:com.liferay.layout.type.controller.display.page: Liferay Portal Vulnerable to Cross-Site Scripting through URLs CVE-2024-39954Mediumorg.apache.eventmesh:eventmesh-runtime: Apache EventMesh Vulnerable to Server-Side Request Forgery in WebhookUtil.java

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo