Maven
5,667 CVEs across 213 months on the top 200 list since Sep 2000. Peak rank #3 in 3 months, last Dec 2023. 43 of them are now in CISA KEV.
Maven CVEs per month since Sep 2000
Dec 2021: 31 CVEs · 5 critical · 2 now in CISA KEV · rank #21 · mostly Io.atomix:atomix, Org.ops4j.pax.logging:pax-logging-log4j2, Org.apache.logging.log4j:log4j-coreJan 2022: 75 CVEs · 15 critical · 0 now in CISA KEV · rank #11 · mostly Net.mingsoft:ms-mcms, Org.apache.kylin:kylin, Org.jenkins-ci.plugins:publish-over-sshFeb 2022: 89 CVEs · 12 critical · 0 now in CISA KEV · rank #10 · mostly Org.jenkins-ci.plugins.workflow:workflow-cps-global-lib, Org.xwiki.platform:xwiki-platform-oldcore, Info.magnolia:magnolia-coreMar 2022: 88 CVEs · 13 critical · 1 now in CISA KEV · rank #9 · mostly Com.liferay.portal:release.dxp.bom, Org.jenkins-ci.plugins:proxmox, Com.surenpi.jenkins:phoenix-autotestApr 2022: 58 CVEs · 7 critical · 3 now in CISA KEV · rank #14 · mostly Com.liferay.portal:release.dxp.bom, Net.sourceforge.htmlunit:neko-htmlunit, Org.owasp.antisamy:antisamyMay 2022: 77 CVEs · 8 critical · 0 now in CISA KEV · rank #6 · mostly Org.jenkins-ci.plugins:autocomplete-parameter, Org.jenkins-ci.plugins:ssh, Org.jenkins-ci.plugins:mercurialJun 2022: 112 CVEs · 7 critical · 0 now in CISA KEV · rank #3 · mostly Org.jenkins-ci.main:jenkins-core, Org.jenkins-ci.plugins:ec2-deployment-dashboard, Com.geteasyqa:easyqaJul 2022: 75 CVEs · 8 critical · 1 now in CISA KEV · rank #9 · mostly Io.dataease:dataease-plugin-common, Org.jenkins-ci.plugins:openshift-deployer, Org.jenkins-ci.plugins:gitAug 2022: 64 CVEs · 9 critical · 1 now in CISA KEV · rank #12 · mostly Org.dspace:dspace-jspui, Org.apache.jspwiki:jspwiki-main, Org.keycloak:keycloak-coreSep 2022: 108 CVEs · 14 critical · 0 now in CISA KEV · rank #6 · mostly Com.fasterxml.woodstox:woodstox-core, Com.liferay.portal:release.dxp.bom, Org.yaml:snakeyamlOct 2022: 73 CVEs · 15 critical · 0 now in CISA KEV · rank #7 · mostly Commons-jxpath:commons-jxpath, Com.liferay.portal:release.dxp.bom, Org.jenkins-ci.plugins:katalonNov 2022: 93 CVEs · 20 critical · 0 now in CISA KEV · rank #7 · mostly Com.liferay.portal:release.portal.bom, Com.liferay.portal:release.dxp.bom, Org.jeecgframework.boot:jeecg-module-systemDec 2022: 56 CVEs · 8 critical · 0 now in CISA KEV · rank #15 · mostly Cn.hutool:hutool-json, Net.mingsoft:ms-mcms, Io.apiman:apiman-manager-api-rest-implJan 2023: 78 CVEs · 15 critical · 0 now in CISA KEV · rank #7 · mostly Org.jenkins-ci.plugins:jira-steps, Io.jenkins.plugins:macstadium-orka, Org.jenkins-ci.plugins:testquality-updaterFeb 2023: 48 CVEs · 6 critical · 0 now in CISA KEV · rank #15 · mostly Org.jenkins-ci.plugins:azure-credentials, Org.jeecgframework.boot:jeecg-boot-base, Org.jenkins-ci.plugins:email-extMar 2023: no snapshot, the run for this month failedApr 2023: 94 CVEs · 40 critical · 0 now in CISA KEV · rank #5 · mostly Org.xwiki.platform:xwiki-platform-oldcore, Tech.powerjob:powerjob, Org.xwiki.platform:xwiki-platform-web-templatesMay 2023: 99 CVEs · 15 critical · 2 now in CISA KEV · rank #3 · mostly Com.liferay.portal:release.portal.bom, Org.apache.inlong:manager-service, Org.apache.inlong:manager-pojoJun 2023: 86 CVEs · 25 critical · 0 now in CISA KEV · rank #8 · mostly Org.jeecgframework.boot:jeecg-boot-parent, Io.grpc:grpc-protobuf, Org.xerial.snappy:snappy-javaJul 2023: 86 CVEs · 21 critical · 0 now in CISA KEV · rank #6 · mostly Com.mabl.integration.jenkins:mabl-integration, Org.jenkins-ci.plugins:dimensionsscm, Org.apache.ambari:ambariAug 2023: 58 CVEs · 8 critical · 0 now in CISA KEV · rank #13 · mostly Org.jenkins-ci.plugins:fortify, Org.jenkins-ci.plugins:cloudbees-folder, Org.graylog2:graylog2-serverSep 2023: 59 CVEs · 6 critical · 0 now in CISA KEV · rank #12 · mostly Org.jenkins-ci.main:jenkins-core, Org.jenkins-ci.plugins:aws-codecommit-trigger, Org.jenkins-ci.plugins:jobconfighistoryOct 2023: 81 CVEs · 26 critical · 2 now in CISA KEV · rank #7 · mostly Com.liferay.portal:release.dxp.bom, Org.xwiki.platform:xwiki-platform-web-templates, Org.yamcs:yamcsNov 2023: 65 CVEs · 14 critical · 0 now in CISA KEV · rank #11 · mostly Org.opencrx:opencrx-core-models, Com.xuxueli:xxl-job-admin, Org.jenkins-ci.plugins:matlabDec 2023: 117 CVEs · 18 critical · 0 now in CISA KEV · rank #3 · mostly Com.jfinal:jfinal, Org.silverpeas.core:silverpeas-core-web, Com.cloudtp.jenkins:paaslane-estimateJan 2024: 62 CVEs · 9 critical · 1 now in CISA KEV · rank #14 · mostly De.tum.in.ase:artemis-java-test-sandbox, Com.jfinal:jfinal, Io.jenkins.plugins:gitlab-branch-sourceFeb 2024: 89 CVEs · 20 critical · 0 now in CISA KEV · rank #8 · mostly Com.liferay.portal:release.portal.bom, Com.liferay.portal:release.dxp.bom, Org.apache.dolphinscheduler:dolphinschedulerMar 2024: 67 CVEs · 6 critical · 0 now in CISA KEV · rank #13 · mostly Org.geoserver:gs-restconfig, Org.jenkins-ci.plugins:htmlpublisher, Org.open-metadata:openmetadata-serviceApr 2024: 50 CVEs · 14 critical · 1 now in CISA KEV · rank #23 · mostly Org.keycloak:keycloak-services, Org.apache.zeppelin:zeppelin-server, Org.xwiki.platform:xwiki-platform-oldcoreMay 2024: 29 CVEs · 5 critical · 0 now in CISA KEV · rank #44 · mostly Org.bouncycastle:bcprov-jdk18on, Org.bouncycastle:bcprov-jdk15to18, Org.bouncycastle:bcprov-jdk14Jun 2024: 31 CVEs · 8 critical · 0 now in CISA KEV · rank #24 · mostly Com.reposilite:reposilite-backend, Org.keycloak:keycloak-services, Org.apache.submarine:submarine-server-coreJul 2024: 48 CVEs · 8 critical · 1 now in CISA KEV · rank #20 · mostly Org.apache.streampark:streampark, Org.geoserver.web:gs-web-app, Org.apache.linkis:linkis-datasourceAug 2024: 27 CVEs · 8 critical · 0 now in CISA KEV · rank #34 · mostly Org.openhab.ui.bundles:org.openhab.ui.cometvisu, Org.apache.dolphinscheduler:dolphinscheduler, Org.apache.linkis:linkisSep 2024: 38 CVEs · 4 critical · 0 now in CISA KEV · rank #18 · mostly Org.keycloak:keycloak-services, Org.keycloak:keycloak-core, Org.xwiki.platform:xwiki-platform-notifications-uiOct 2024: 44 CVEs · 7 critical · 0 now in CISA KEV · rank #21 · mostly Com.liferay.portal:release.dxp.bom, Com.liferay.portal:release.portal.bom, Org.openrefine:openrefineNov 2024: 48 CVEs · 5 critical · 0 now in CISA KEV · rank #19 · mostly Org.keycloak:keycloak-quarkus-server, Org.keycloak:keycloak-services, Ca.uhn.hapi.fhir:org.hl7.fhir.dstu3Dec 2024: 39 CVEs · 10 critical · 0 now in CISA KEV · rank #20 · mostly Org.apache.tomcat:tomcat-catalina, Org.keycloak:keycloak-quarkus-server, Org.apache.tomcat.embed:tomcat-embed-coreJan 2025: 43 CVEs · 4 critical · 0 now in CISA KEV · rank #24 · mostly Com.ruoyi:ruoyi, Org.jboss.hal:hal-console, Org.hl7.fhir.publisher:org.hl7.fhir.publisher.coreFeb 2025: 27 CVEs · 3 critical · 1 now in CISA KEV · rank #26 · mostly Org.apache.cassandra:cassandra-all, Org.keycloak:keycloak-services, Io.netty:netty-commonMar 2025: 64 CVEs · 8 critical · 1 now in CISA KEV · rank #15 · mostly Ai.h2o:h2o-core, Io.github.robothy:local-s3-rest, Org.jenkins-ci.main:jenkins-coreApr 2025: 56 CVEs · 10 critical · 0 now in CISA KEV · rank #17 · mostly Org.keycloak:keycloak-services, Org.opencms:opencms-core, Org.elasticsearch:elasticsearchMay 2025: 35 CVEs · 7 critical · 0 now in CISA KEV · rank #30 · mostly Org.apache.inlong:manager-pojo, Org.jenkins-ci.plugins:vmanager-plugin, Org.graylog2:graylog2-serverJun 2025: 58 CVEs · 9 critical · 0 now in CISA KEV · rank #16 · mostly Org.geoserver.web:gs-web-app, Org.geoserver:gs-wfs, Org.apache.tomcat.embed:tomcat-embed-coreJul 2025: 69 CVEs · 6 critical · 0 now in CISA KEV · rank #19 · mostly Org.glassfish.main.admingui:console-common, Org.keycloak:keycloak-services, Org.jenkins-ci.plugins:applitools-eyesAug 2025: 81 CVEs · 10 critical · 0 now in CISA KEV · rank #7 · mostly Com.liferay.portal:release.portal.bom, Org.pytorch:executorch-android, Com.liferay.portal:release.dxp.bomSep 2025: 90 CVEs · 6 critical · 0 now in CISA KEV · rank #13 · mostly Com.liferay.portal:release.portal.bom, Com.liferay.portal:com.liferay.portal.impl, Org.jenkins-ci.main:jenkins-coreOct 2025: 103 CVEs · 5 critical · 0 now in CISA KEV · rank #7 · mostly Com.liferay.portal:release.portal.bom, Com.liferay.portal:com.liferay.portal.impl, Com.liferay:com.liferay.change.tracking.webNov 2025: 30 CVEs · 2 critical · 1 now in CISA KEV · rank #21 · mostly Org.geoserver:gs-wms, Org.geoserver.web:gs-web-app, Lsfusion.platform:web-clientDec 2025: 48 CVEs · 2 critical · 0 now in CISA KEV · rank #21 · mostly Org.jenkins-ci.main:jenkins-core, Org.nutz:nutzboot-parent, Org.apache.streampark:streamparkJan 2026: 53 CVEs · 6 critical · 0 now in CISA KEV · rank #15 · mostly Net.gleske:jervis, Org.keycloak:keycloak-services, Org.apache.solr:solr-coreFeb 2026: 39 CVEs · 5 critical · 0 now in CISA KEV · rank #23 · mostly Org.keycloak:keycloak-services, Org.apache.tomcat:tomcat, Org.apache.tomcat.embed:tomcat-embed-coreMar 2026: 23 CVEs · 7 critical · 0 now in CISA KEV · rank #49 · mostly Org.keycloak:keycloak-services, Org.apache.livy:livy-server, Org.apache.iotdb:iotdb-coreApr 2026: 9 CVEs · 0 critical · 0 now in CISA KEV · rank #124 · mostly Dev.dsf:dsf-bpe-server, Io.quarkiverse.openapi.generator:quarkus-openapi-generator, Org.asynchttpclient:async-http-clientMay 2026: 7 CVEs · 0 critical · 0 now in CISA KEV · rank #194 · mostly Org.opensearch.plugin:opensearch-security, Land.oras:oras-java-sdk, Org.jdbi:jdbi3-freemarkerJun 2026: 12 CVEs · 0 critical · 0 now in CISA KEV · rank #100 · mostly Org.http4k:http4k-core, Org.jline:jline-remote-telnet, Com.appsmith:serverJul 2026: 19 CVEs · 0 critical · 0 now in CISA KEV · rank #65 · mostly Org.http4s:blaze-http_2.13, Com.arcadedb:arcadedb-engine, Org.http4s:blaze-http_3Aug 2026: below the top 200 that month, 8 or fewer CVEsSep 2026: below the top 200 that month, 9 or fewer CVEsOct 2026: below the top 200 that month, 11 or fewer CVEsNov 2026: none that month (the list had room for every one)
In the lens
The products that kept showing up in Maven's monthly top three from Dec 2021 to Nov 2026. Move the lens and the list follows.
- Com.liferay.portal:release.portal.bom103
- Com.liferay.portal:release.dxp.bom79
- Org.keycloak:keycloak-services42
- Com.jfinal:jfinal31
- Org.jenkins-ci.main:jenkins-core23
- Org.xwiki.platform:xwiki-platform-oldcore13
- Org.geoserver.web:gs-web-app11
- Com.liferay.portal:com.liferay.portal.impl10
- Org.apache.inlong:manager-pojo10
- Ai.h2o:h2o-core9
Year by year
Each year's months on the top 200 list. Pick a year to read it in the lens.
The record
- Peak rank
- #3 in 3 months, last Dec 2023
- Busiest month
- Dec 2023, 117 CVEs
- Months with a KEV entry
- 35 of 213 on the list
- On the top 200 list
- 213 of 296 monthly snapshots