Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-53606Highorg.apache.seata:seata-serializer-fury: Apache Seata: Deserialization of untrusted Data in Apache Seata Server CVE-2025-30404Criticalexecutorch: ExecuTorch integer overflow vulnerability CVE-2025-54949Criticalexecutorch: ExecuTorch heap buffer overflow vulnerability CVE-2025-54950Criticalexecutorch: ExecuTorch out-of-bounds access vulnerability CVE-2025-30405Criticalexecutorch: ExecuTorch integer overflow vulnerability CVE-2025-54951Criticalexecutorch: ExecuTorch vulnerable to Heap-based Buffer Overflow CVE-2025-54125Highorg.xwiki.platform:xwiki-platform-oldcore: XWiki exposes passwords and emails stored in fields not named password/email in xml.vm CVE-2025-54124Highorg.xwiki.platform:xwiki-platform-oldcore: XWiki leaks password hashes and other accessible password properties CVE-2025-32430Mediumorg.xwiki.platform:xwiki-platform-web-templates: XWiki allows Reflected XSS in two templates CVE-2025-4604Mediumcom.liferay:com.liferay.captcha.impl: Liferay Portal CAPTCHA Bypass for Gogo Shell CVE-2024-41177Mediumorg.apache.zeppelin:zeppelin-web: Apache Zeppelin: XSS in the Helium module CVE-2024-52279Mediumorg.apache.zeppelin:zeppelin-jdbc: Apache Zeppelin: Arbitrary file read by adding malicious JDBC connection string CVE-2024-51775Mediumorg.apache.zeppelin:zeppelin-shell: Apache Zeppelin: Missing Origin Validation in WebSockets vulnerability GHSA-2RJV-CV85-XHGMMediumorg.opensearch.plugin:opensearch-security: OpenSearch unauthorized data access on fields protected by field level security if field is a member of an object GHSA-RRMM-WQ7Q-H4V5Mediumorg.opensearch.plugin:opensearch-security: OpenSearch unauthorized data access on fields protected by field masking for fields of type ip, geo_point, geo_shape, xy_point, xy_shape CVE-2025-24853Mediumorg.apache.jspwiki:jspwiki-main: Apache JSPWiki Cross-Site Scripting (XSS) Vulnerability via Header Link Rendering CVE-2025-24854Mediumorg.apache.jspwiki:jspwiki-main: Apache JSPWiki Cross-Site Scripting (XSS) Vulnerability in the Image Plugin CVE-2025-54656Mediumorg.apache.struts:struts-extras: Apache Struts Extras Before 2 has an Improper Output Neutralization for Logs Vulnerability CVE-2025-7784Mediumorg.keycloak:keycloak-services: Keycloak Privilege Escalation Vulnerability in Admin Console (FGAPv2 Enabled)CVE-2025-7365Mediumorg.keycloak:keycloak-services: Keycloak phishing attack via email verification step in first login flow CVE-2025-54380Mediumorg.opencastproject:opencast-common: Opencast still publishes global system account credentials CVE-2025-54385Highorg.xwiki.platform:xwiki-platform-oldcore: XWiki Platform vulnerable to SQL injection through XWiki#searchDocuments API CVE-2025-32429Criticalorg.xwiki.platform:xwiki-platform-distribution-war: XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter CVE-2025-7962Mediumorg.eclipse.angus:smtp: Jakarta Mail vulnerable to SMTP Injection CVE-2025-50151Highorg.apache.jena:jena: Apache Jena doesn't validate file access paths in configuration files uploaded by users with administrator access

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.