Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2023-6886Mediumcom.xnx3.wangmarket:wangmarket: Xnx3 Wangmarket Cross-Site Scripting vulnerabilityCVE-2023-50723Criticalorg.xwiki.platform:xwiki-platform-administration-ui: Remote code execution/programming rights with configuration section from any user accountCVE-2023-50722Criticalorg.xwiki.platform:xwiki-platform-administration-ui: XSS/CSRF Remote Code Execution in XWiki.ConfigurableClassCVE-2023-50721Criticalorg.xwiki.platform:xwiki-platform-search-ui: Remote code execution from account through SearchAdminCVE-2023-50720Mediumorg.xwiki.platform:xwiki-platform-search-solr-api: Solr search discloses email addresses of usersCVE-2023-50719Highorg.xwiki.platform:xwiki-platform-search-solr-api: Solr search discloses password hashes of all usersGHSA-QQHQ-8R2C-C3F5Loworg.owasp:dependency-check-ant: nvdApiKey is logged in debug modeCVE-2023-49898Criticalorg.apache.streampark:streampark: Apache StreamPark: Authenticated system users could trigger remote command executionCVE-2023-30867Mediumorg.apache.streampark:streampark: Apache StreamPark: Authenticated system users could trigger SQL injection vulnerabilityCVE-2023-6837Highorg.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework: Multiple WSO2 products vulnerable to perform user impersonatoin using JIT provisioningCVE-2023-6835Mediumorg.wso2.carbon.apimgt:forum: WSO2 API Manager allows attackers to change the API ratingCVE-2023-6836Mediumorg.wso2.carbon.commons:org.wso2.carbon.ntask.core: WSO2 products vulnerable to XML External Entity attackCVE-2023-46279Criticalorg.apache.dubbo:dubbo: Apache Dubbo: Bypass deny serialize list check in Apache DubboCVE-2023-29234Criticalorg.apache.dubbo:dubbo: Bypass serialize checks in Apache DubboCVE-2023-6563Highorg.keycloak:keycloak-model-jpa: Allocation of Resources Without Limits in KeycloakCVE-2023-50101Mediumcom.jfinal:jfinal: Cross-site Scripting in JFinalcmsCVE-2023-50102Mediumcom.jfinal:jfinal: Cross-site Scripting in JFinalcmsCVE-2023-50100Mediumcom.jfinal:jfinal: Cross-site Scripting in JFinalcmsCVE-2023-50137Mediumcom.jfinal:jfinal: Cross-site Scripting in JFinalcmsCVE-2023-46750Mediumorg.apache.shiro:shiro-web: Open redirect in Apache ShiroCVE-2023-50772Mediumcom.zintow:dingding-json-pusher: Tokens stored in plain text by Dingding JSON Pusher Plugin CVE-2023-50773Mediumcom.zintow:dingding-json-pusher: Displayed in plain text by Dingding JSON Pusher Plugin CVE-2023-50777Mediumcom.cloudtp.jenkins:paaslane-estimate: Tokens stored in plain text by PaaSLane Estimate Plugin CVE-2023-50779Mediumcom.cloudtp.jenkins:paaslane-estimate: Missing permission check in Jenkins PaaSLane Estimate PluginCVE-2023-50771Mediumorg.jenkins-ci.plugins:oic-auth: Open redirect vulnerability in Jenkins OpenId Connect Authentication Plugin

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo