Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2024-2419Highorg.keycloak:keycloak-services: Keycloak path traversal vulnerability in the redirect validation CVE-2024-3825Mediumcom.blazemeter.plugins:BlazeMeterJenkinsPlugin: BlazeMeter Jenkins plugin vulnerable to Cross-Site Request Forgery CVE-2024-22262Highorg.springframework:spring-web: Spring Framework URL Parsing with Host Validation CVE-2024-27309Highorg.apache.kafka:kafka-metadata: Apache Kafka: Potential incorrect access control during migration from ZK mode to KRaft mode CVE-2024-31861Mediumorg.apache.zeppelin:zeppelin-shell: Code injection in Apache Zeppelin Shell CVE-2024-31997Criticalorg.xwiki.platform:xwiki-platform-uiextension-api: XWiki Platform remote code execution from account through UIExtension parameters CVE-2024-31996Criticalorg.xwiki.commons:xwiki-commons-velocity: XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution CVE-2024-31988Criticalorg.xwiki.platform:xwiki-platform-realtime-ui: XWiki Platform CSRF remote code execution through the realtime HTML Converter API CVE-2024-31987Criticalorg.xwiki.platform:xwiki-platform-oldcore: XWiki Platform remote code execution from account via custom skins support CVE-2024-31986Criticalorg.xwiki.platform:xwiki-platform-scheduler-ui: XWiki Platform CSRF remote code execution through scheduler job's document reference CVE-2024-31985Mediumorg.xwiki.platform:xwiki-platform-scheduler-ui: XWiki Platform CSRF in the job scheduler CVE-2024-31984Criticalorg.xwiki.platform:xwiki-platform-search-solr-ui: XWiki Platform: Remote code execution through space title and Solr space facet CVE-2024-31983Criticalorg.xwiki.platform:xwiki-platform-localization-source-wiki: XWiki Platform: Remote code execution from edit in multilingual wikis via translations CVE-2024-31982Criticalorg.xwiki.platform:xwiki-platform-search-ui: XWiki Platform: Remote code execution as guest via DatabaseSearch CVE-2024-31981Criticalorg.xwiki.platform:xwiki-platform-oldcore: XWiki Platform: Privilege escalation (PR) from user registration through PDFClass CVE-2024-31465Criticalorg.xwiki.platform:xwiki-platform-search-ui: XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet CVE-2024-31464Mediumorg.xwiki.platform:xwiki-platform-oldcore: XWiki Platform: Password hash might be leaked by diff once the xobject holding them is deleted CVE-2023-6236Highorg.wildfly.security:wildfly-elytron-http-oidc: WildFly Elytron: OIDC app attempting to access the second tenant, the user should be prompted to log CVE-2024-31867Mediumorg.apache.zeppelin:zeppelin-server: Apache Zeppelin: LDAP search filter query Injection Vulnerability CVE-2024-31868Mediumorg.apache.zeppelin:zeppelin-interpreter: Apache Zeppelin vulnerable to cross-site scripting in the helium module CVE-2024-31864Criticalorg.apache.zeppelin:zeppelin-jdbc: Apache Zeppelin remote code execution by adding malicious JDBC connection string CVE-2024-31865Mediumorg.apache.zeppelin:zeppelin-server: Apache Zeppelin: Cron arbitrary user impersonation with improper privileges CVE-2024-31866Criticalorg.apache.zeppelin:zeppelin-interpreter: Improper escaping in Apache Zeppelin CVE-2021-22573Highcom.google.oauth-client:google-oauth-client: google-oauth-java-client improperly verifies cryptographic signature CVE-2024-31863Mediumorg.apache.zeppelin:zeppelin-server: Apache Zeppelin: Replacing other users notebook, bypassing any permissions

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo