Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2023-0872Highorg.opennms:opennms-webapp-rest: OpenNMS privilege elevation vulnerabilityCVE-2023-0871Highorg.opennms.core:org.opennms.core.xml: OpenNMS Horizon XXE Injection VulnerabilityCVE-2020-24922Highcom.xuxueli:xxl-job: xuxueli xxl-job Cross-Site Request Forgery VulnerabilityCVE-2023-3894Highcom.fasterxml.jackson.dataformat:jackson-dataformat-toml: Denial of service in jackson-dataformat-tomlCVE-2022-41401Mediumorg.openrefine:main: OpenRefine Server-Side Request Forgery vulnerabilityCVE-2023-36480Criticalcom.aerospike:aerospike-client: Aerospike Java Client vulnerable to unsafe deserialization of server responsesCVE-2023-4136Highorg.craftercms:crafter-engine: Cross-site Scripting (XSS) in CrafterCMSCVE-2023-3426Mediumcom.liferay:com.liferay.organizations.item.selector.web: Liferay Portal and Liferay DXP Organization Selector Does Not Check User Permissions GHSA-XQCQ-J8W9-3PXVMediumcom.tencyle.fixes:org.codehaus.jettison--jettison: Jettison parser crash by stackoverflowCVE-2023-36542Highorg.apache.nifi:nifi-cdc-mysql-bundle: Apache NiFi Code Injection vulnerabilityCVE-2023-39010Criticalorg.boofcv:boofcv-core: Code injection in BoofCVCVE-2023-39021Criticalcom.wix:wix-embedded-mysql: Code injection in wix-embedded-mysqlCVE-2023-39020Criticaledu.stanford.nlp:stanford-parser: Code injection in stanford-parserCVE-2023-37754Criticaltech.powerjob:powerjob-common: Code injection in PowerJobCVE-2023-39022Criticalopensymphony:oscore: Code injection in oscoreCVE-2023-38992Criticalorg.jeecgframework.boot:jeecg-boot-common: SQL injection in jeecg-bootCVE-2023-39015Criticalus.codecraft:webmagic-core: Code injection in webmagic-coreCVE-2023-39013Criticalno.priv.garshol.duke:duke: Code injection in DukeCVE-2023-3990Lownet.mingsoft:ms-mcms: Cross-site Scripting in Mingsoft MCMSCVE-2023-38509Mediumorg.xwiki.platform:xwiki-platform-livetable-ui: Obfuscated email addresses should not be sortedCVE-2023-3442Highio.jenkins.plugins:servicenow-devops: Missing authorization in Jenkins Plug-in for ServiceNow CVE-2023-3414Mediumio.jenkins.plugins:servicenow-devops: Credential leakage in Jenkins Plug-in for ServiceNow CVE-2023-39151Highorg.jenkins-ci.main:jenkins-core: Jenkins Stored Cross-site Scripting vulnerability CVE-2023-39154Mediumcom.qualys.plugins:qualys-was: Incorrect permission checks in Qualys Web App Scanning Connector Plugin allow capturing credentials CVE-2023-39153Mediumorg.jenkins-ci.plugins:gitlab-oauth: CSRF vulnerability in GitLab Authentication Plugin

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo