Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-68R5-9HPG-7QW9Criticalorg.openidentityplatform.opendj:opendj-dsml-servlet: OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gatewayCVE-2026-62379Criticalorg.openidentityplatform.openam:openam-core: OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallbackCVE-2026-62280Mediumorg.openidentityplatform.openam:openam-oauth2: OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent pageCVE-2026-62263Criticalorg.openidentityplatform.openam:openam-auth-webauthn: OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypassCVE-2026-73507Highio.netty:netty-codec-xml: Netty: Denial of Service in XmlFrameDecoder via CPU ExhaustionCVE-2026-73508Mediumio.netty:netty-codec-dns: Netty: Memory Leak in DNS Record Decoder via Malformed Domain NamesGHSA-464C-974J-9XM6Lowaws-cdk-lib: AWS CDK CodeBuild S3 Log Encryption Boolean InversionCVE-2026-59949Mediumat.yawk.lz4:lz4-java: LZ4 Java: Native XXHash implementations can crash the JVM when passed invalid byte array rangesCVE-2026-55223Mediumcom.mchange:c3p0: c3p0 can, in combination with other libraries, compose to a "sink" for deserialization gadgetsCVE-2026-16723Criticalcom.alibaba:fastjson: fastjson has a remote code execution (RCE) vulnerabilityCVE-2024-7708Highorg.eclipse.jetty:jetty-server: Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requestsCVE-2026-8384Mediumorg.eclipse.jetty:jetty-util: Eclipse Jetty: Path parameter traversalCVE-2026-6790Mediumorg.eclipse.jetty:jetty-server: Eclipse Jetty: HTTP Authority/Host mismatchCVE-2026-10051Mediumorg.eclipse.jetty:jetty-server: Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connectionsCVE-2026-10050Highorg.eclipse.jetty:jetty-security: Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitutionCVE-2026-59921Mediumio.netty:netty-codec-http: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoderCVE-2026-59920Mediumio.netty:netty-codec-stomp: Netty: STOMP CONNECT Frame Header Injection in NettyCVE-2026-59919Mediumio.netty:netty-codec-haproxy: Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX AddressCVE-2026-59901Highio.netty:netty-codec-compression: Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread HangCVE-2026-59900Mediumio.netty:netty-codec-http2: Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing BypassCVE-2026-59899Mediumio.netty:netty-codec-http: Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of ServiceCVE-2026-59898Mediumio.netty:netty-codec-http: Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validationCVE-2026-56822Highio.netty:netty-handler-ssl-ocsp: Netty: TOCTOU in OcspServerCertificateValidatorCVE-2026-56821Highio.netty:netty-handler-ssl-ocsp: Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidatorCVE-2026-56820Highio.netty:netty-handler-ssl-ocsp: Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo