Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2024-38369Criticalorg.xwiki.platform:xwiki-platform-rendering-macro-include: XWiki programming rights may be inherited by inclusion CVE-2024-29868Criticalorg.apache.streampipes:streampipes-resource-management: Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generation CVE-2024-27136Mediumorg.apache.jspwiki:jspwiki-main: Cross site scripting in Apache JSPWiki CVE-2024-5967Loworg.keycloak:keycloak-ldap-federation: Keycloak leaks configured LDAP bind credentials through the Keycloak admin console CVE-2021-47621Mediumio.github.classgraph:classgraph: ClassGraph XML External Entity Reference CVE-2024-37899Criticalorg.xwiki.platform:xwiki-platform-oldcore: XWiki Platform allows remote code execution from user account CVE-2024-6162Highio.undertow:undertow-core: Undertow's url-encoded request path information can be broken on ajp-listener CVE-2024-36543Highio.strimzi:strimzi: STRIMZI incorrect access control CVE-2024-37902Criticalai.djl:api: DeepJavaLibrary API absolute path traversal CVE-2024-38460Mediumorg.sonarsource.sonarqube:sonar-web: SonarQube logs sensitive information CVE-2024-37309Mediumio.crate:crate: CrateDB has a Client initialized Session-Renegotiation DoS CVE-2024-37280Mediumorg.elasticsearch:elasticsearch: Elasticsearch StackOverflow vulnerability CVE-2024-1722Loworg.keycloak:keycloak-services: Keycloak Denial of Service via account lockout CVE-2021-3754Loworg.keycloak:keycloak-services: Keycloak's improper input validation allows using email as username CVE-2024-36263Highorg.apache.submarine:submarine-server-core: Apache Submarine Server Core has a SQL Injection Vulnerability CVE-2024-36265Criticalorg.apache.submarine:submarine-server-core: Apache Submarine Server Core Incorrect Authorization vulnerability CVE-2024-23445Mediumorg.elasticsearch:elasticsearch: Elasticsearch Remote Cluster Search Cross Cluster API Key insufficient restrictions CVE-2024-36264Mediumorg.apache.submarine:submarine-commons-utils: Apache Submarine Commons Utils has a hard-coded secret CVE-2024-3656Highorg.keycloak:keycloak-services: Keycloak's admin API allows low privilege users to use administrative functions CVE-2024-35255Mediumazure-identity: Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability CVE-2024-4540Highorg.keycloak:keycloak-services: Keycloak exposes sensitive information in Pushed Authorization Requests (PAR)CVE-2024-36823Mediumorg.ninjaframework:ninja-core: Weak encryption in Ninja Core CVE-2024-36121Mediumio.netty.incubator:netty-incubator-codec-ohttp: BoringSSLAEADContext in Netty Repeats Nonces CVE-2024-36124Mediumorg.iq80.snappy:snappy: iq80 Snappy out-of-bounds read when uncompressing data, leading to JVM crash CVE-2024-36042Criticalorg.silverpeas.core:silverpeas-core: Silverpeas authentication bypass

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.