Maven Package Vulnerabilities

All 3,216 Java / JVM artifacts with known CVEs, ranked by live CVE volume — 8,471 package-to-CVE mappings with affected ranges and fixed versions. Updated continuously as new vulnerabilities publish.

  1. 1.org.jenkins-ci.main:jenkins-core259 CVEs
  2. 2.org.apache.tomcat:tomcat164 CVEs
  3. 3.com.liferay.portal:release.portal.bom159 CVEs
  4. 4.com.liferay.portal:release.dxp.bom125 CVEs
  5. 5.org.keycloak:keycloak-services97 CVEs
  6. 6.com.fasterxml.jackson.core:jackson-databind85 CVEs
  7. 7.org.apache.tomcat.embed:tomcat-embed-core78 CVEs
  8. 8.org.apache.struts:struts2-core60 CVEs
  9. 9.org.keycloak:keycloak-core48 CVEs
  10. 10.org.apache.tomcat:tomcat-catalina46 CVEs
  11. 11.org.xwiki.platform:xwiki-platform-oldcore46 CVEs
  12. 12.org.elasticsearch:elasticsearch43 CVEs
  13. 13.net.mingsoft:ms-mcms39 CVEs
  14. 14.io.undertow:undertow-core38 CVEs
  15. 15.com.thoughtworks.xstream:xstream37 CVEs
  16. 16.org.jenkins-ci.plugins:script-security37 CVEs
  17. 17.com.jfinal:jfinal36 CVEs
  18. 18.org.apache.tomcat:tomcat-coyote34 CVEs
  19. 19.org.apache.solr:solr-core31 CVEs
  20. 20.org.opencms:opencms-core31 CVEs
  21. 21.org.springframework.security:spring-security-core31 CVEs
  22. 22.org.eclipse.jetty:jetty-server29 CVEs
  23. 23.org.bouncycastle:bcprov-jdk1426 CVEs
  24. 24.org.apache.openmeetings:openmeetings-parent25 CVEs
  25. 25.org.bouncycastle:bcprov-jdk15on25 CVEs
  26. 26.org.springframework:spring-webmvc25 CVEs
  27. 27.io.netty:netty-codec-http24 CVEs
  28. 28.org.keycloak:keycloak-parent24 CVEs
  29. 29.org.xwiki.platform:xwiki-platform-web-templates23 CVEs
  30. 30.org.apache.nifi:nifi21 CVEs
  31. 31.org.cloudfoundry.identity:cloudfoundry-identity-server21 CVEs
  32. 32.org.springframework:spring-core19 CVEs
  33. 33.com.liferay.portal:com.liferay.portal.impl18 CVEs
  34. 34.org.apache.activemq:activemq-client18 CVEs
  35. 35.org.apache.jspwiki:jspwiki-main18 CVEs
  36. 36.org.springframework:spring-webflux18 CVEs
  37. 37.org.apache.dolphinscheduler:dolphinscheduler17 CVEs
  38. 38.org.apache.geode:geode-core17 CVEs
  39. 39.org.apache.inlong:manager-pojo17 CVEs
  40. 40.org.apache.ranger:ranger17 CVEs
  41. 41.org.apache.dubbo:dubbo16 CVEs
  42. 42.org.apache.struts.xwork:xwork-core16 CVEs
  43. 43.org.bouncycastle:bcprov-jdk1516 CVEs
  44. 44.org.geoserver.web:gs-web-app16 CVEs
  45. 45.org.yamcs:yamcs-core16 CVEs
  46. 46.ai.h2o:h2o-core15 CVEs
  47. 47.org.apache.activemq:apache-activemq15 CVEs
  48. 48.org.bouncycastle:bcprov-jdk15to1815 CVEs
  49. 49.org.graylog2:graylog2-server15 CVEs
  50. 50.org.xwiki.platform:xwiki-platform-web15 CVEs

Which Maven packages run in YOUR stack?

EchelonGraph inventories your dependencies and correlates them against live CVE intelligence — affected ranges, fixed versions, and blast radius in one graph.

Book a Demo →