Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-9796Mediumorg.keycloak:keycloak-server: Keycloak has a Time-of-check Time-of-use (TOCTOU) Race ConditionCVE-2026-9794Mediumorg.keycloak:keycloak-services: Keycloak Generates an Error Message Containing Sensitive InformationCVE-2026-9792Mediumorg.keycloak:keycloak-services: Keycloak Vulnerable to Improper Handling of Insufficient Permissions or PrivilegeCVE-2026-9791Mediumorg.keycloak:keycloak-server-spi-private: Keycloak Vulnerable to Incorrect AuthorizationCVE-2026-46621Criticalorg.yamcs:yamcs-core: Yamcs Vulnerable to Authenticated Remote Code Execution (RCE) via Jython Algorithm Code InjectionCVE-2026-46562Criticalorg.yamcs:yamcs-core: Yamcs Vulnerable to Remote Code Execution via Mission Database algorithm overrideCVE-2026-48927Mediumorg.jenkins-ci.plugins:buildgraph-view: Jenkins buildgraph-view Plugin does not escape the build URLCVE-2026-9674Mediumorg.jenkins-ci.plugins:jenkins-multijob-plugin: Jenkins Multijob Plugin has a cross-site request forgery (CSRF) vulnerabilityCVE-2026-48924Mediumorg.jenkins-ci.plugins:bitbucket-oauth: Jenkins Bitbucket OAuth Plugin does not restrict the redirect URL after loginCVE-2026-48926Mediumorg.jenkins-ci.plugins:job-import-plugin: Jenkins Job Import Plugin does not perform a permission check in an HTTP endpointCVE-2026-48925Mediumorg.jenkins-ci.plugins:github-integration-parent: Jenkins GitHub Integration Plugin has a cross-site request forgery (CSRF) vulnerabilityCVE-2026-48923Mediumcom.rapid7:jenkinsci-appspider-plugin: Jenkins AppSpider Plugin does not perform a permission check in a method implementing form validationCVE-2026-48922Highorg.jenkins-ci.plugins:credentials-binding: Jenkins Credentials Binding Plugin does not properly sanitize file names for file and zip file credentialsCVE-2026-48919Mediumorg.jenkins-ci.plugins:active-directory: Jenkins Active Directory Plugin deserializes data from LDAP referrals without validationCVE-2026-48916Mediumorg.jenkins-ci.plugins:ldap: Jenkins LDAP Plugin follows LDAP referralsCVE-2026-48918Mediumorg.jenkins-ci.plugins:active-directory: Jenkins Active Directory Plugin follows LDAP referrals by defaultCVE-2026-48917Mediumorg.jenkins-ci.plugins:ldap: Jenkins LDAP Plugin deserializes data from LDAP referrals without validationCVE-2026-48921Highio.jenkins.plugins:pipeline-groovy-lib: Jenkins Pipeline: Groovy Libraries Plugin does not prohibit symbolic links in shared librariesCVE-2026-48920Highorg.jenkins-ci.plugins:email-ext: Jenkins Email Extension Plugin: Attackers able to control email content may specify `file:` URLs for images to read arbitrary files from…CVE-2026-9704Mediumorg.keycloak:keycloak-server-spi-private: Keycloak Vulnerable to Improper Validation of Specified Quantity in InputCVE-2026-9689Mediumorg.keycloak:keycloak-services: Keycloak Services has Improper Validation of Consistency within InputCVE-2026-44632Criticalorg.yamcs:yamcs-core: Yamcs Vulnerable to Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory`CVE-2026-44596Mediumorg.yamcs:yamcs-core: Yamcs has No Rate Limiting on Authentication EndpointCVE-2026-44595Mediumorg.yamcs:yamcs-core: Yamcs vulnerable to unauthorized user enumeration via IAM API endpointsCVE-2026-42568Mediumorg.yamcs:yamcs-core: Yamcs Vulnerable to LDAP Injection in LdapAuthModule

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo