Maven Package Vulnerabilities

All 3,246 Java / JVM artifacts with known CVEs, ranked by live CVE volume — 8,603 package-to-CVE mappings with affected ranges and fixed versions. Updated continuously as new vulnerabilities publish.

  1. 2,051.org.apache.cocoon:cocoon-sitemap-impl1 CVE
  2. 2,052.org.apache.commons:commons-beanutils21 CVE
  3. 2,053.org.apache.commons:commons-fileupload2-core1 CVE
  4. 2,054.org.apache.commons:commons-io1 CVE
  5. 2,055.org.apache.commons:commons-lang31 CVE
  6. 2,056.org.apache.commons:commons-text1 CVE
  7. 2,057.org.apache.cxf:cxf-integration-jca1 CVE
  8. 2,058.org.apache.cxf:cxf-rt-databinding-aegis1 CVE
  9. 2,059.org.apache.cxf:cxf-rt-management1 CVE
  10. 2,060.org.apache.cxf:cxf-rt-rs-security-jose1 CVE
  11. 2,061.org.apache.cxf:cxf-rt-rs-security-jose-jaxrs1 CVE
  12. 2,062.org.apache.cxf:cxf-rt-rs-security-sso-saml1 CVE
  13. 2,063.org.apache.cxf:cxf-rt-rs-service-description1 CVE
  14. 2,064.org.apache.cxf:cxf-rt-ws-security1 CVE
  15. 2,065.org.apache.cxf:cxf-rt-ws-transfer1 CVE
  16. 2,066.org.apache.cxf.fediz:fediz-core1 CVE
  17. 2,067.org.apache.cxf.fediz:fediz-idp1 CVE
  18. 2,068.org.apache.cxf.fediz:fediz-oidc1 CVE
  19. 2,069.org.apache.cxf.karaf:apache-cxf1 CVE
  20. 2,070.org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap1 CVE
  21. 2,071.org.apache.ddlutils:ddlutils1 CVE
  22. 2,072.org.apache.deltaspike:deltaspike1 CVE
  23. 2,073.org.apache.deltaspike.modules:jsf-module-project1 CVE
  24. 2,074.org.apache.directory.api:apache-ldap-api1 CVE
  25. 2,075.org.apache.directory.api:api-ldap-client-api1 CVE
  26. 2,076.org.apache.directory.api:api-ldap-model1 CVE
  27. 2,077.org.apache.directory.studio:org.apache.directory.studio.ldapbrowser.core1 CVE
  28. 2,078.org.apache.directory.studio:org.apache.directory.studio.parent1 CVE
  29. 2,079.org.apache.dolphinscheduler:dolphinscheduler-alert-plugins1 CVE
  30. 2,080.org.apache.dolphinscheduler:dolphinscheduler-dao1 CVE
  31. 2,081.org.apache.dolphinscheduler:dolphinscheduler-rpc1 CVE
  32. 2,082.org.apache.dolphinscheduler:dolphinscheduler-server1 CVE
  33. 2,083.org.apache.dolphinscheduler:dolphinscheduler-service1 CVE
  34. 2,084.org.apache.dolphinscheduler:dolphinscheduler-task-api1 CVE
  35. 2,085.org.apache.drill:drill-common1 CVE
  36. 2,086.org.apache.drill.exec:drill-java-exec1 CVE
  37. 2,087.org.apache.druid.extensions:druid-basic-security1 CVE
  38. 2,088.org.apache.druid.extensions:druid-pac4j1 CVE
  39. 2,089.org.apache.dubbo:dubbo-common1 CVE
  40. 2,090.org.apache.dubbo:dubbo-rpc-http-invoker1 CVE
  41. 2,091.org.apache.eventmesh:eventmesh-connector-rabbitmq1 CVE
  42. 2,092.org.apache.eventmesh:eventmesh-meta-raft1 CVE
  43. 2,093.org.apache.eventmesh:eventmesh-runtime1 CVE
  44. 2,094.org.apache-extras.beanshell:bsh1 CVE
  45. 2,095.org.apache.felix:org.apache.felix.healthcheck.webconsoleplugin1 CVE
  46. 2,096.org.apache.felix:org.apache.felix.http.webconsoleplugin1 CVE
  47. 2,097.org.apache.felix:org.apache.felix.webconsole1 CVE
  48. 2,098.org.apache.fesod:fesod-sheet1 CVE
  49. 2,099.org.apache.flex.blazeds:flex-messaging-core1 CVE
  50. 2,100.org.apache.flex.blazeds:flex-messaging-remoting1 CVE

Which Maven packages run in YOUR stack?

EchelonGraph inventories your dependencies and correlates them against live CVE intelligence — affected ranges, fixed versions, and blast radius in one graph.

Book a Demo →