Vulnerability Database · Ecosystem

Maven vulnerabilities

Maven is covered by 7,152 vulnerabilities in the Vulert Vulnerability Database, each with the severity, affected versions, workaround and the fix for the version you actually run.

Search all 7,152 vulnerabilities Malicious packages in Maven Critical vulnerabilities only

Vulnerabilities recorded: 7,152
Critical: 940
High: 2,391
Medium / Low: 3,403 / 417
Unrated: 0
Last database update: 22/Oct/2026

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

Scan your app free →

01 Severity in Maven

How the vulnerabilities split

Critical 940
High 2,391
Medium 3,403
Low 417
Unrated 0

Totals add up to the 7,152 vulnerabilities Vulert records for Maven, including entries with no severity published yet.

Other ways into the data

02 Most recent critical

Newest critical Maven vulnerabilities

See all critical Maven vulnerabilities →

9.3 CVSS

CVE-2026-107726: Hazelcast Arbitrary Memory Access Vulnerability

com.hazelcast:hazelcast · Maven · disclosed 08 Oct 2026

5.7.0 fixed version
9.4 CVSS

CVE-2026-107282: AsyncHttpClient Replay Vulnerability Exposing Credentials to Different Hosts

org.asynchttpclient:async-http-client · Maven · disclosed 08 Oct 2026

3.0.13 fixed version
9.3 CVSS

CVE-2026-61741: http4s-scala-xml XML External Entity (XXE) Processing Vulnerability

org.http4s:http4s-scala-xml_2.12 · Maven · disclosed 24 Sep 2026

0.24.1 fixed version

03 Related ecosystems

Other platforms in this database

npm 230,688 Debian 106,974 Ubuntu 50,092 PyPI 26,494 Red Hat 24,060 Linux 15,912 Bitnami 9,947 Go 9,914 Alpine 8,588 Packagist 7,347

Subscribe to Vulert on Telegram

Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.

Join the channel →

Questions

Maven and the database

How many Maven vulnerabilities does Vulert track?

Maven is covered by 7,152 vulnerabilities, each with the severity, affected versions, workaround and fix where one exists.

How do I fix a vulnerability in Maven?

Open the vulnerability for the package and version you run. It lists the vulnerable range, the fixed version to move to, and a workaround when no fix has been published yet.

Does Vulert monitor Maven dependencies continuously?

Yes. Upload the manifest or SBOM for your application and Vulert keeps tracking those packages, alerting you when a new vulnerability affects a version you actually use.