Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-47884Criticalorg.springframework:spring-webmvc: Spring Framework Improper Path Limitation in XsltViewCVE-2026-47892Criticalorg.springframework:spring-webflux: Spring Framework Header Predicate Bypass in WebFlux Functional EndpointsCVE-2026-55688Mediumorg.asynchttpclient:async-http-client: AsyncHttpClient stores cookie for an unrelated domain (cookie tossing) via ThreadSafeCookieStoreCVE-2026-54550Highorg.codehaus.izpack:izpack-installer: IzPack has Path Traversal in UnpackerBase that allows writing files outside the installation directory via malicious pack entriesCVE-2026-54556Highorg.http4s:http4s-ember-core_2.12: http4s has HTTP/2 Denial of Service with Ember BackendCVE-2026-65637Criticalorg.apache.tomcat:tomcat-coyote: Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validationCVE-2026-65905Criticalorg.apache.tomcat:tomcat: Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerabilityCVE-2026-65182Criticalorg.apache.tomcat:tomcat: Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerabilityCVE-2026-68525Criticalorg.apache.tomcat:tomcat: Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerabilityCVE-2026-54050Mediumorg.sakaiproject.profile2:profile2-api: Sakai Profile Image Deletion has an IDORCVE-2026-54049Highorg.sakaiproject.conversations:sakai-conversations-impl: Sakai Conversations has a Stored XSS IssueCVE-2026-78329Criticalorg.apache.camel:camel-undertow: Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow…CVE-2026-59230Mediumorg.apache.camel:camel-mail: Apache Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when…CVE-2026-63621Mediumorg.apache.camel:camel-knative: Apache Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any…CVE-2026-60093Mediumorg.apache.camel:camel-azure-storage-datalake: Apache Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without…CVE-2026-71300Criticalorg.apache.camel:camel-atmosphere-websocket: Apache Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers…CVE-2026-66908Highorg.apache.camel:camel-platform-http-main: Apache Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims…CVE-2026-66907Highorg.apache.camel:camel-google-storage: Apache Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining…CVE-2026-66906Criticalorg.apache.camel:camel-azure-storage-blob: Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without…CVE-2026-76904Criticalorg.geotools.jdbc:gt-jdbc-postgis: GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layersCVE-2026-63202Highio.netty.incubator:netty-incubator-codec-bhttp: netty-incubator-codec-ohttp BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decodingCVE-2026-61827Highio.netty.incubator:netty-incubator-codec-bhttp: netty-incubator-codec-ohttp: BinaryHttpParser should enforce limits for variable lengths fieldsCVE-2026-63124Highio.netty.incubator:netty-incubator-codec-bhttp: netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundaryCVE-2026-61799Mediumio.netty.incubator:netty-incubator-codec-bhttp: netty-incubator-codec-ohttp: Binary HTTP parser unchecked varint length overflow causes decoder crashCVE-2026-61798Highio.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl: netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo