Maven

This hub aggregates every CVE we track for Maven, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Maven.

• CVE-2023-6378Logback "receiver" DOS vulnerability 7.1Nov 29, 2023
• CVE-2023-2976Use of temporary directory for file creation in `FileBackedOutputStream` in Guava5.5Jun 14, 2023
• CVE-2022-40159Stack Overflow in JXPath6.5Oct 6, 2022
• CVE-2022-40160Stack Overflow in JXPath6.5Oct 6, 2022
• CVE-2022-29599Commandline class shell injection vulnerabilities9.8May 23, 2022
• CVE-2021-26291block repositories using http by default9.1Apr 23, 2021
• CVE-2021-29425Possible limited path traversal vulnerabily in Apache Commons IO4.8Apr 13, 2021
• CVE-2021-26719A directory traversal issue was discovered in Gradle gradle-enterprise-test-distribution-agent before 1.3.2, test-distribution-gradle-plugin before 1.3.2, and gradle-enterprise-maven-extension befo...6.5Feb 9, 2021
• CVE-2020-8908Temp directory permission issue in Guava3.3Dec 10, 2020
• CVE-2020-15250Information disclosure in JUnit44.4Oct 12, 2020
• CVE-2020-15777An issue was discovered in the Maven Extension plugin before 1.6 for Gradle Enterprise. The extension uses a socket connection to send serialized Java objects. Deserialization is not restricted to ...7.8Aug 25, 2020
• CVE-2019-16549Jenkins Maven Release Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks, allowing man-in-the-middle attackers to have Jenkins parse crafted XM...8.1Dec 17, 2019
• CVE-2019-16550A cross-site request forgery vulnerability in a connection test form method in Jenkins Maven Release Plugin 0.16.1 and earlier allows attackers to have Jenkins connect to an attacker specified web ...8.8Dec 17, 2019
• CVE-2019-10358Jenkins Maven Integration Plugin 3.3 and earlier did not apply build log decorators to module builds, potentially revealing sensitive build variables in the build log.6.5Jul 31, 2019
• CVE-2019-9843In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resol...7.5Mar 15, 2019