CVE Tools
Track your stack

Maven

18 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Maven, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Maven CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Maven CVEs per month
MonthCVEs
2024-110
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-120
2026-010
2026-020
2026-030
2026-040
2026-050
2026-060
2026-070
2026-080
2026-090
2026-101

Severity

How the 18 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical212%
  • High529%
  • Medium953%
  • Low16%

Latest CVEs

The 15 most recently published vulnerabilities affecting Maven.

  1. CVE-2026-119282Nx: OS command injection via nx.json plugin options in @nx/maven and @nx/gradle—
  2. CVE-2023-6378Logback "receiver" DOS vulnerability 7.1
  3. CVE-2023-2976Use of temporary directory for file creation in `FileBackedOutputStream` in Guava5.5
  4. CVE-2022-40159Stack Overflow in JXPath6.5
  5. CVE-2022-40160Stack Overflow in JXPath6.5
  6. CVE-2022-29599Commandline class shell injection vulnerabilities9.8
  7. CVE-2021-26291block repositories using http by default9.1
  8. CVE-2021-29425Possible limited path traversal vulnerabily in Apache Commons IO4.8
  9. CVE-2021-26719A directory traversal issue was discovered in Gradle gradle-enterprise-test-distribution-agent before 1.3.2, test-distribution-gradle-plugin before 1.3.2, and gradle-enterprise-maven-extension befo...6.5
  10. CVE-2020-8908Temp directory permission issue in Guava3.3
  11. CVE-2020-15250Information disclosure in JUnit44.4
  12. CVE-2020-15777An issue was discovered in the Maven Extension plugin before 1.6 for Gradle Enterprise. The extension uses a socket connection to send serialized Java objects. Deserialization is not restricted to ...7.8
  13. CVE-2019-16549Jenkins Maven Release Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks, allowing man-in-the-middle attackers to have Jenkins parse crafted XM...8.1
  14. CVE-2019-16550A cross-site request forgery vulnerability in a connection test form method in Jenkins Maven Release Plugin 0.16.1 and earlier allows attackers to have Jenkins connect to an attacker specified web ...8.8
  15. CVE-2019-10358Jenkins Maven Integration Plugin 3.3 and earlier did not apply build log decorators to module builds, potentially revealing sensitive build variables in the build log.6.5

Product grouping is registry-driven, with AI assist and human review. How it works