Maven
5,667 CVEs across 213 months on the top 200 list since Sep 2000. Peak rank #3 in 3 months, last Dec 2023. 43 of them are now in CISA KEV.
Maven CVEs per month since Sep 2000
Aug 2021: 51 CVEs · 2 critical · 1 now in CISA KEV · rank #16 · mostly Com.liferay.portal:release.dxp.bom, Com.liferay.portal:release.portal.bom, Com.thoughtworks.xstream:xstreamSep 2021: 26 CVEs · 10 critical · 0 now in CISA KEV · rank #26 · mostly Org.apache.dubbo:dubbo, Org.apache.zeppelin:zeppelin, Org.http4s:http4s-server_2.11Oct 2021: 27 CVEs · 5 critical · 0 now in CISA KEV · rank #29 · mostly Org.webjars.npm:jquery-ui, Edu.stanford.nlp:stanford-corenlp, Org.apache.storm:stormNov 2021: 46 CVEs · 18 critical · 0 now in CISA KEV · rank #12 · mostly Org.jenkins-ci.main:jenkins-core, Org.apache.ozone:ozone-main, Software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdkDec 2021: 31 CVEs · 5 critical · 2 now in CISA KEV · rank #21 · mostly Io.atomix:atomix, Org.ops4j.pax.logging:pax-logging-log4j2, Org.apache.logging.log4j:log4j-coreJan 2022: 75 CVEs · 15 critical · 0 now in CISA KEV · rank #11 · mostly Net.mingsoft:ms-mcms, Org.apache.kylin:kylin, Org.jenkins-ci.plugins:publish-over-sshFeb 2022: 89 CVEs · 12 critical · 0 now in CISA KEV · rank #10 · mostly Org.jenkins-ci.plugins.workflow:workflow-cps-global-lib, Org.xwiki.platform:xwiki-platform-oldcore, Info.magnolia:magnolia-coreMar 2022: 88 CVEs · 13 critical · 1 now in CISA KEV · rank #9 · mostly Com.liferay.portal:release.dxp.bom, Org.jenkins-ci.plugins:proxmox, Com.surenpi.jenkins:phoenix-autotestApr 2022: 58 CVEs · 7 critical · 3 now in CISA KEV · rank #14 · mostly Com.liferay.portal:release.dxp.bom, Net.sourceforge.htmlunit:neko-htmlunit, Org.owasp.antisamy:antisamyMay 2022: 77 CVEs · 8 critical · 0 now in CISA KEV · rank #6 · mostly Org.jenkins-ci.plugins:autocomplete-parameter, Org.jenkins-ci.plugins:ssh, Org.jenkins-ci.plugins:mercurialJun 2022: 112 CVEs · 7 critical · 0 now in CISA KEV · rank #3 · mostly Org.jenkins-ci.main:jenkins-core, Org.jenkins-ci.plugins:ec2-deployment-dashboard, Com.geteasyqa:easyqaJul 2022: 75 CVEs · 8 critical · 1 now in CISA KEV · rank #9 · mostly Io.dataease:dataease-plugin-common, Org.jenkins-ci.plugins:openshift-deployer, Org.jenkins-ci.plugins:gitAug 2022: 64 CVEs · 9 critical · 1 now in CISA KEV · rank #12 · mostly Org.dspace:dspace-jspui, Org.apache.jspwiki:jspwiki-main, Org.keycloak:keycloak-coreSep 2022: 108 CVEs · 14 critical · 0 now in CISA KEV · rank #6 · mostly Com.fasterxml.woodstox:woodstox-core, Com.liferay.portal:release.dxp.bom, Org.yaml:snakeyamlOct 2022: 73 CVEs · 15 critical · 0 now in CISA KEV · rank #7 · mostly Commons-jxpath:commons-jxpath, Com.liferay.portal:release.dxp.bom, Org.jenkins-ci.plugins:katalonNov 2022: 93 CVEs · 20 critical · 0 now in CISA KEV · rank #7 · mostly Com.liferay.portal:release.portal.bom, Com.liferay.portal:release.dxp.bom, Org.jeecgframework.boot:jeecg-module-systemDec 2022: 56 CVEs · 8 critical · 0 now in CISA KEV · rank #15 · mostly Cn.hutool:hutool-json, Net.mingsoft:ms-mcms, Io.apiman:apiman-manager-api-rest-implJan 2023: 78 CVEs · 15 critical · 0 now in CISA KEV · rank #7 · mostly Org.jenkins-ci.plugins:jira-steps, Io.jenkins.plugins:macstadium-orka, Org.jenkins-ci.plugins:testquality-updaterFeb 2023: 48 CVEs · 6 critical · 0 now in CISA KEV · rank #15 · mostly Org.jenkins-ci.plugins:azure-credentials, Org.jeecgframework.boot:jeecg-boot-base, Org.jenkins-ci.plugins:email-extMar 2023: not on the top 200 that monthApr 2023: 94 CVEs · 40 critical · 0 now in CISA KEV · rank #5 · mostly Org.xwiki.platform:xwiki-platform-oldcore, Tech.powerjob:powerjob, Org.xwiki.platform:xwiki-platform-web-templatesMay 2023: 99 CVEs · 15 critical · 2 now in CISA KEV · rank #3 · mostly Com.liferay.portal:release.portal.bom, Org.apache.inlong:manager-service, Org.apache.inlong:manager-pojoJun 2023: 86 CVEs · 25 critical · 0 now in CISA KEV · rank #8 · mostly Org.jeecgframework.boot:jeecg-boot-parent, Io.grpc:grpc-protobuf, Org.xerial.snappy:snappy-javaJul 2023: 86 CVEs · 21 critical · 0 now in CISA KEV · rank #6 · mostly Com.mabl.integration.jenkins:mabl-integration, Org.jenkins-ci.plugins:dimensionsscm, Org.apache.ambari:ambariAug 2023: 58 CVEs · 8 critical · 0 now in CISA KEV · rank #13 · mostly Org.jenkins-ci.plugins:fortify, Org.jenkins-ci.plugins:cloudbees-folder, Org.graylog2:graylog2-serverSep 2023: 59 CVEs · 6 critical · 0 now in CISA KEV · rank #12 · mostly Org.jenkins-ci.main:jenkins-core, Org.jenkins-ci.plugins:aws-codecommit-trigger, Org.jenkins-ci.plugins:jobconfighistoryOct 2023: 81 CVEs · 26 critical · 2 now in CISA KEV · rank #7 · mostly Com.liferay.portal:release.dxp.bom, Org.xwiki.platform:xwiki-platform-web-templates, Org.yamcs:yamcsNov 2023: 65 CVEs · 14 critical · 0 now in CISA KEV · rank #11 · mostly Org.opencrx:opencrx-core-models, Com.xuxueli:xxl-job-admin, Org.jenkins-ci.plugins:matlabDec 2023: 117 CVEs · 18 critical · 0 now in CISA KEV · rank #3 · mostly Com.jfinal:jfinal, Org.silverpeas.core:silverpeas-core-web, Com.cloudtp.jenkins:paaslane-estimateJan 2024: 62 CVEs · 9 critical · 1 now in CISA KEV · rank #14 · mostly De.tum.in.ase:artemis-java-test-sandbox, Com.jfinal:jfinal, Io.jenkins.plugins:gitlab-branch-sourceFeb 2024: 89 CVEs · 20 critical · 0 now in CISA KEV · rank #8 · mostly Com.liferay.portal:release.portal.bom, Com.liferay.portal:release.dxp.bom, Org.apache.dolphinscheduler:dolphinschedulerMar 2024: 67 CVEs · 6 critical · 0 now in CISA KEV · rank #13 · mostly Org.geoserver:gs-restconfig, Org.jenkins-ci.plugins:htmlpublisher, Org.open-metadata:openmetadata-serviceApr 2024: 50 CVEs · 14 critical · 1 now in CISA KEV · rank #23 · mostly Org.keycloak:keycloak-services, Org.apache.zeppelin:zeppelin-server, Org.xwiki.platform:xwiki-platform-oldcoreMay 2024: 29 CVEs · 5 critical · 0 now in CISA KEV · rank #44 · mostly Org.bouncycastle:bcprov-jdk18on, Org.bouncycastle:bcprov-jdk15to18, Org.bouncycastle:bcprov-jdk14Jun 2024: 31 CVEs · 8 critical · 0 now in CISA KEV · rank #24 · mostly Com.reposilite:reposilite-backend, Org.keycloak:keycloak-services, Org.apache.submarine:submarine-server-coreJul 2024: 48 CVEs · 8 critical · 1 now in CISA KEV · rank #20 · mostly Org.apache.streampark:streampark, Org.geoserver.web:gs-web-app, Org.apache.linkis:linkis-datasourceAug 2024: 27 CVEs · 8 critical · 0 now in CISA KEV · rank #34 · mostly Org.openhab.ui.bundles:org.openhab.ui.cometvisu, Org.apache.dolphinscheduler:dolphinscheduler, Org.apache.linkis:linkisSep 2024: 38 CVEs · 4 critical · 0 now in CISA KEV · rank #18 · mostly Org.keycloak:keycloak-services, Org.keycloak:keycloak-core, Org.xwiki.platform:xwiki-platform-notifications-uiOct 2024: 44 CVEs · 7 critical · 0 now in CISA KEV · rank #21 · mostly Com.liferay.portal:release.dxp.bom, Com.liferay.portal:release.portal.bom, Org.openrefine:openrefineNov 2024: 48 CVEs · 5 critical · 0 now in CISA KEV · rank #19 · mostly Org.keycloak:keycloak-quarkus-server, Org.keycloak:keycloak-services, Ca.uhn.hapi.fhir:org.hl7.fhir.dstu3Dec 2024: 39 CVEs · 10 critical · 0 now in CISA KEV · rank #20 · mostly Org.apache.tomcat:tomcat-catalina, Org.keycloak:keycloak-quarkus-server, Org.apache.tomcat.embed:tomcat-embed-coreJan 2025: 43 CVEs · 4 critical · 0 now in CISA KEV · rank #24 · mostly Com.ruoyi:ruoyi, Org.jboss.hal:hal-console, Org.hl7.fhir.publisher:org.hl7.fhir.publisher.coreFeb 2025: 27 CVEs · 3 critical · 1 now in CISA KEV · rank #26 · mostly Org.apache.cassandra:cassandra-all, Org.keycloak:keycloak-services, Io.netty:netty-commonMar 2025: 64 CVEs · 8 critical · 1 now in CISA KEV · rank #15 · mostly Ai.h2o:h2o-core, Io.github.robothy:local-s3-rest, Org.jenkins-ci.main:jenkins-coreApr 2025: 56 CVEs · 10 critical · 0 now in CISA KEV · rank #17 · mostly Org.keycloak:keycloak-services, Org.opencms:opencms-core, Org.elasticsearch:elasticsearchMay 2025: 35 CVEs · 7 critical · 0 now in CISA KEV · rank #30 · mostly Org.apache.inlong:manager-pojo, Org.jenkins-ci.plugins:vmanager-plugin, Org.graylog2:graylog2-serverJun 2025: 58 CVEs · 9 critical · 0 now in CISA KEV · rank #16 · mostly Org.geoserver.web:gs-web-app, Org.geoserver:gs-wfs, Org.apache.tomcat.embed:tomcat-embed-coreJul 2025: 69 CVEs · 6 critical · 0 now in CISA KEV · rank #19 · mostly Org.glassfish.main.admingui:console-common, Org.keycloak:keycloak-services, Org.jenkins-ci.plugins:applitools-eyesAug 2025: 81 CVEs · 10 critical · 0 now in CISA KEV · rank #7 · mostly Com.liferay.portal:release.portal.bom, Org.pytorch:executorch-android, Com.liferay.portal:release.dxp.bomSep 2025: 90 CVEs · 6 critical · 0 now in CISA KEV · rank #13 · mostly Com.liferay.portal:release.portal.bom, Com.liferay.portal:com.liferay.portal.impl, Org.jenkins-ci.main:jenkins-coreOct 2025: 103 CVEs · 5 critical · 0 now in CISA KEV · rank #7 · mostly Com.liferay.portal:release.portal.bom, Com.liferay.portal:com.liferay.portal.impl, Com.liferay:com.liferay.change.tracking.webNov 2025: 30 CVEs · 2 critical · 1 now in CISA KEV · rank #21 · mostly Org.geoserver:gs-wms, Org.geoserver.web:gs-web-app, Lsfusion.platform:web-clientDec 2025: 48 CVEs · 2 critical · 0 now in CISA KEV · rank #21 · mostly Org.jenkins-ci.main:jenkins-core, Org.nutz:nutzboot-parent, Org.apache.streampark:streamparkJan 2026: 53 CVEs · 6 critical · 0 now in CISA KEV · rank #15 · mostly Net.gleske:jervis, Org.keycloak:keycloak-services, Org.apache.solr:solr-coreFeb 2026: 39 CVEs · 5 critical · 0 now in CISA KEV · rank #23 · mostly Org.keycloak:keycloak-services, Org.apache.tomcat:tomcat, Org.apache.tomcat.embed:tomcat-embed-coreMar 2026: 23 CVEs · 7 critical · 0 now in CISA KEV · rank #49 · mostly Org.keycloak:keycloak-services, Org.apache.livy:livy-server, Org.apache.iotdb:iotdb-coreApr 2026: 9 CVEs · 0 critical · 0 now in CISA KEV · rank #124 · mostly Dev.dsf:dsf-bpe-server, Io.quarkiverse.openapi.generator:quarkus-openapi-generator, Org.asynchttpclient:async-http-clientMay 2026: 7 CVEs · 0 critical · 0 now in CISA KEV · rank #194 · mostly Org.opensearch.plugin:opensearch-security, Land.oras:oras-java-sdk, Org.jdbi:jdbi3-freemarkerJun 2026: 12 CVEs · 0 critical · 0 now in CISA KEV · rank #100 · mostly Org.http4k:http4k-core, Org.jline:jline-remote-telnet, Com.appsmith:serverJul 2026: 19 CVEs · 0 critical · 0 now in CISA KEV · rank #65 · mostly Org.http4s:blaze-http_2.13, Com.arcadedb:arcadedb-engine, Org.http4s:blaze-http_3
In the lens
The products that kept showing up in Maven's monthly top three from Aug 2021 to Jul 2026. Move the lens and the list follows.
- Com.liferay.portal:release.portal.bom117
- Com.liferay.portal:release.dxp.bom96
- Org.keycloak:keycloak-services42
- Org.jenkins-ci.main:jenkins-core36
- Com.jfinal:jfinal31
- Com.thoughtworks.xstream:xstream14
- Org.xwiki.platform:xwiki-platform-oldcore13
- Org.geoserver.web:gs-web-app11
- Com.liferay.portal:com.liferay.portal.impl10
- Org.apache.inlong:manager-pojo10
Year by year
Each year's months on the top 200 list. Pick a year to read it in the lens.
The record
- Peak rank
- #3 in 3 months, last Dec 2023
- Busiest month
- Dec 2023, 117 CVEs
- Months with a KEV entry
- 35 of 213 on the list
- On the top 200 list
- 213 of 311 monthly snapshots