Skip to content
OpenAdvisories

Ecosystem

Maven

7,126 known vulnerabilities.

Most affected packages

org.jenkins-ci.main:jenkins-core 259 org.apache.tomcat:tomcat 168 com.liferay.portal:release.portal.bom 159 com.liferay.portal:release.dxp.bom 125 org.keycloak:keycloak-services 104 com.fasterxml.jackson.core:jackson-databind 86 org.apache.tomcat.embed:tomcat-embed-core 82 org.apache.struts:struts2-core 60 org.keycloak:keycloak-core 49 org.xwiki.platform:xwiki-platform-oldcore 46 org.apache.tomcat:tomcat-catalina 44 io.undertow:undertow-core 42 org.elasticsearch:elasticsearch 40 net.mingsoft:ms-mcms 39 com.thoughtworks.xstream:xstream 37 org.jenkins-ci.plugins:script-security 37 com.jfinal:jfinal 36 org.apache.tomcat:tomcat-coyote 34 org.apache.solr:solr-core 31 org.springframework.security:spring-security-core 31 org.opencms:opencms-core 31 org.eclipse.jetty:jetty-server 29 org.springframework:spring-webmvc 27 org.bouncycastle:bcprov-jdk14 26 org.keycloak:keycloak-parent 26 org.bouncycastle:bcprov-jdk15on 25 org.apache.openmeetings:openmeetings-parent 25 io.netty:netty-codec-http 24 org.apache.activemq:apache-activemq 23 org.xwiki.platform:xwiki-platform-web-templates 23 org.apache.nifi:nifi 21 org.cloudfoundry.identity:cloudfoundry-identity-server 21 org.apache.activemq:activemq-client 20 org.springframework:spring-webflux 20 org.springframework:spring-core 19 com.liferay.portal:com.liferay.portal.impl 18 org.asynchttpclient:async-http-client 18 com.vaadin:vaadin-bom 18 org.apache.jspwiki:jspwiki-main 18 org.apache.activemq:activemq-all 17
All Critical High Medium Low Exploited only Public exploit

58 results · Clear filters · Feed

  • Critical 9.8
    CVE-2017-1000353 Exploited Public exploit EPSS 100%

    Deserialization of Untrusted Data in Jenkins

    Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java `SignedObject` object to the…

    org.jenkins-ci.main:jenkins-core Maven
    KEV Oct 2, 2025
  • Critical 9.8
    CVE-2017-1000486 Exploited Public exploit Scanner template EPSS 94%

    Inadequate Encryption Strength

    Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution

    org.primefaces:primefaces Maven
    KEV Jan 10, 2022
  • Critical 9.8
    CVE-2015-7501 Exploited Public exploit Scanner template EPSS 86%

    Deserialization of Untrusted Data in Apache commons collections

    Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal …

    commons-collections:commons-collections org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic org.apache.commons:commons-collections4 libcommons-collections3-java Debian Ubuntu Maven
  • High 8.1
    CVE-2017-12617 Exploited Public exploit Scanner template EPSS 100%

    Unrestricted Upload of File with Dangerous Type Apache Tomcat

    When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP fil…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
    KEV Mar 25, 2022
  • High 8.1
    CVE-2017-12615 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    When running Apache Tomcat on Windows with HTTP PUTs enabled it was possible to upload a JSP file to the server

    When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could th…

    Apache Software Foundation Apache Tomcat org.apache.tomcat.embed:tomcat-embed-core Maven
    KEV Mar 25, 2022
  • High 8.1
    CVE-2017-9805 Exploited Public exploit Scanner template EPSS 99%

    REST Plugin in Apache Struts uses an XStreamHandler with an instance of XStream for deserialization without any type filtering

    The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloa…

    Apache Software Foundation Apache Struts org.apache.struts:struts2-rest-plugin Maven
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2017-9791 Exploited Public exploit Scanner template EPSS 99%

    Code execution in Apache Struts 1 plugin

    The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.

    Apache Software Foundation Apache Struts org.apache.struts:struts2-struts1-plugin Maven
    KEV Feb 10, 2022
  • Critical 9.8
    CVE-2016-8735 Exploited EPSS 90%

    Apache Tomcat Improper Access Control vulnerability

    Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this lis…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
    KEV May 12, 2023
  • Critical 9.8
    CVE-2017-5638 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Apache Struts vulnerable to remote arbitrary command execution due to improper input validation

    The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted …

    Apache Software Foundation Apache Struts org.apache.struts:struts2-core Maven
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2016-4437 Exploited Public exploit Scanner template EPSS 93%

    Improper Access Control in Apache Shiro

    Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

    shiro shiro org.apache.shiro:shiro-core Debian Ubuntu Maven
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2016-3088 Exploited Public exploit Scanner template EPSS 98%

    Improper Input Validation in Apache ActiveMQ

    The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.

    activemq activemq org.apache.activemq:activemq-client Debian Ubuntu Maven
    KEV Feb 10, 2022
  • High 8.1
    CVE-2016-3081 Exploited Public exploit Scanner template EPSS 97%

    Apache Struts RCE Vulnerability

    Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.

    org.apache.struts:struts2-core Maven
    KEV Oct 8, 2026
  • High 7.5
    CVE-2015-5317 Exploited EPSS 23%

    Jenkins discloses project names via fingerprints

    The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request.

    org.jenkins-ci.main:jenkins-core Maven
    KEV May 12, 2023
  • Critical 9.8
    CVE-2015-1427 Exploited Public exploit Scanner template EPSS 100%

    Improper Access Control in Elasticsearch

    The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

    org.elasticsearch:elasticsearch Maven
    KEV Mar 25, 2022
  • High 8.1
    CVE-2014-3120 Exploited Public exploit Scanner template EPSS 89%

    Elasticsearch Improper Access Control vulnerability

    The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security pol…

    org.elasticsearch:elasticsearch Maven
    KEV Mar 25, 2022
  • Critical 9.8
    CVE-2013-2251 Exploited Public exploit Scanner template EPSS 100%

    Code injection in Apache Struts

    Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.

    org.apache.struts:struts2-core Maven
    KEV Mar 25, 2022
  • Critical 9.8
    CVE-2012-0391 Exploited Public exploit EPSS 76%

    Apache Struts Remote Java Code Execution

    The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a craf…

    org.apache.struts:struts2-core org.apache.struts.xwork:xwork-core Maven
    KEV Jan 21, 2022
  • High 7.5
    CVE-2006-1547 Exploited EPSS 55%

    Improper Input Validation in Apache Struts

    ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler metho…

    struts:struts Maven
    KEV Jan 21, 2022