Maven
17 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Maven, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Maven CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 17 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical2
- High5
- Medium9
- Low1
Latest CVEs
The 15 most recently published vulnerabilities affecting Maven.
- CVE-2023-6378Logback "receiver" DOS vulnerability 7.1
- CVE-2023-2976Use of temporary directory for file creation in `FileBackedOutputStream` in Guava5.5
- CVE-2022-40160Stack Overflow in JXPath6.5
- CVE-2022-40159Stack Overflow in JXPath6.5
- CVE-2022-29599Commandline class shell injection vulnerabilities9.8
- CVE-2021-26291block repositories using http by default9.1
- CVE-2021-29425Possible limited path traversal vulnerabily in Apache Commons IO4.8
- CVE-2021-26719A directory traversal issue was discovered in Gradle gradle-enterprise-test-distribution-agent before 1.3.2, test-distribution-gradle-plugin before 1.3.2, and gradle-enterprise-maven-extension befo...6.5
- CVE-2020-8908Temp directory permission issue in Guava3.3
- CVE-2020-15250Information disclosure in JUnit44.4
- CVE-2020-15777An issue was discovered in the Maven Extension plugin before 1.6 for Gradle Enterprise. The extension uses a socket connection to send serialized Java objects. Deserialization is not restricted to ...7.8
- CVE-2019-16549Jenkins Maven Release Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks, allowing man-in-the-middle attackers to have Jenkins parse crafted XM...8.1
- CVE-2019-16550A cross-site request forgery vulnerability in a connection test form method in Jenkins Maven Release Plugin 0.16.1 and earlier allows attackers to have Jenkins connect to an attacker specified web ...8.8
- CVE-2019-10358Jenkins Maven Integration Plugin 3.3 and earlier did not apply build log decorators to module builds, potentially revealing sensitive build variables in the build log.6.5
- CVE-2019-9843In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resol...7.5
Product grouping is registry-driven, with AI assist and human review. How it works