VulnSea

Tagged “maven”

CVEs tagged maven, newest first.

321 CVEsRSS

CVE-2026-57305Medium· 5.4
3mo ago

Jenkins Assembla Plugin has a cross-site request forgery (CSRF) vulnerability

Jenkins Assembla Plugin has a cross-site request forgery (CSRF) vulnerability

▾ Sunlitjenkins-ci · org.jenkins-ci.plugins:assemblaEPSS 0.22%via GHSA
CVE-2026-57304Medium· 5.4
3mo ago

Jenkins Assembla Plugin has a missing permission check

Jenkins Assembla Plugin has a missing permission check

▾ Sunlitjenkins-ci · org.jenkins-ci.plugins:assemblaEPSS 0.25%via GHSA
CVE-2026-57307Medium· 4.2
3mo ago

Jenkins Zowe zDevOps Plugin has a missing permission check

Jenkins Zowe zDevOps Plugin has a missing permission check

▾ Sunlitjenkins · io.jenkins.plugins:zdevopsEPSS 0.21%via GHSA
CVE-2026-12986High
3mo ago

Payara Server Full has a Cross-Site Request Forgery vulnerability

Payara Server Full has a Cross-Site Request Forgery vulnerability

▾ Twilightpayara · fish.payara.distributions:payaraEPSS 0.27%via GHSA
CVE-2026-57296High· 8.8
3mo ago

Jenkins External Workspace Manager Plugin has a path traversal vulnerability

Jenkins External Workspace Manager Plugin has a path traversal vulnerability

▾ Twilightjenkins-ci · org.jenkins-ci.plugins:external-workspace-managerEPSS 0.83%via GHSA
CVE-2026-57295Medium· 5.4
3mo ago

Jenkins EC2 Fleet Plugin has a cross-site request forgery (CSRF) vulnerability

Jenkins EC2 Fleet Plugin has a cross-site request forgery (CSRF) vulnerability

▾ Sunlitamazon · com.amazon.jenkins.fleet:ec2-fleetEPSS 0.22%via GHSA
CVE-2026-57288Low· 3.7
3mo ago

Jenkins Active Directory Plugin has an LDAP injection vulnerability

Jenkins Active Directory Plugin has an LDAP injection vulnerability

▾ Sunlitjenkins-ci · org.jenkins-ci.plugins:active-directoryEPSS 0.33%via GHSA
CVE-2026-57294Medium· 5.4
3mo ago

Jenkins EC2 Fleet Plugin has a missing permission check

Jenkins EC2 Fleet Plugin has a missing permission check

▾ Sunlitamazon · com.amazon.jenkins.fleet:ec2-fleetEPSS 0.25%via GHSA
CVE-2026-57293Medium· 4.3
3mo ago

Jenkins Gitee Plugin has an incorrect permission check that allows enumerating credentials IDs

Jenkins Gitee Plugin has an incorrect permission check that allows enumerating credentials IDs

▾ Sunlitjenkins-ci · org.jenkins-ci.plugins:giteeEPSS 0.27%via GHSA
CVE-2026-57292Medium· 5.4
3mo ago

Jenkins Gitee Plugin has a cross-site request forgery vulnerability

Jenkins Gitee Plugin has a cross-site request forgery vulnerability

▾ Sunlitjenkins-ci · org.jenkins-ci.plugins:giteeEPSS 0.14%via GHSA
CVE-2026-57290Medium· 4.3
3mo ago

Jenkins Priority Sorter Plugin has a CSRF vulnerability

Jenkins Priority Sorter Plugin has a CSRF vulnerability

▾ Sunlitjenkins-ci · org.jenkins-ci.plugins:PrioritySorterEPSS 0.25%via GHSA
CVE-2026-57289Medium· 4.8
3mo ago

Jenkins Bitbucket Push and Pull Request Plugin unconditionally disables SSL/TLS certificate validation

Jenkins Bitbucket Push and Pull Request Plugin unconditionally disables SSL/TLS certificate validation

▾ Sunlitjenkins · io.jenkins.plugins:bitbucket-push-and-pull-requestEPSS 0.16%via GHSA
CVE-2026-57298Medium· 5.4
3mo ago

Jenkins Contrast Continuous Application Security Plugin has a CSRF vulnerability

Jenkins Contrast Continuous Application Security Plugin has a CSRF vulnerability

▾ Sunlitjenkins-ci · org.jenkins-ci.plugins:contrast-continuous-application-securityEPSS 0.14%via GHSA
CVE-2026-57291Medium· 5.4
3mo ago

Jenkins Gitee Plugin missing permission checks

Jenkins Gitee Plugin missing permission checks

▾ Sunlitjenkins-ci · org.jenkins-ci.plugins:giteeEPSS 0.23%via GHSA
CVE-2026-57280High· 8.8
3mo ago

Jenkins Script Security Plugin sandbox bypass vulnerability

Jenkins Script Security Plugin sandbox bypass vulnerability

▾ Twilightjenkins-ci · org.jenkins-ci.plugins:script-securityEPSS 0.51%via GHSA
CVE-2026-57281High· 7.5
3mo ago

Jenkins Script Security Plugin has a script security bypass vulnerability

Jenkins Script Security Plugin has a script security bypass vulnerability

▾ Twilightjenkins-ci · org.jenkins-ci.plugins:script-securityEPSS 0.92%via GHSA
CVE-2026-57286Medium· 4.3
3mo ago

Jenkins Git Parameter Plugin has a missing permission check that allows listing SCM branch and tag names

Jenkins Git Parameter Plugin has a missing permission check that allows listing SCM branch and tag names

▾ Sunlitjenkins-ci · org.jenkins-ci.tools:git-parameterEPSS 0.28%via GHSA
CVE-2026-57284Medium· 4.3
3mo ago

Jenkins Pipeline: Groovy Plugin vulnerable to unrestricted instantiation of types

Jenkins Pipeline: Groovy Plugin vulnerable to unrestricted instantiation of types

▾ Sunlitjenkins · io.jenkins.plugins:pipeline-groovy-libEPSS 0.34%via GHSA
CVE-2026-57282Medium· 5.0
3mo ago

Jenkins Git client Plugin has an OS command injection vulnerability on agents

Jenkins Git client Plugin has an OS command injection vulnerability on agents

▾ Sunlitjenkins-ci · org.jenkins-ci.plugins:git-clientEPSS 0.25%via GHSA
CVE-2026-57285Medium· 4.3
3mo ago

Jenkins GitHub Branch Source Plugin has missing permission check that allows enumerating GitHub Enterprise server URLs

Jenkins GitHub Branch Source Plugin has missing permission check that allows enumerating GitHub Enterprise server URLs

▾ Sunlitjenkins-ci · org.jenkins-ci.plugins:github-branch-sourceEPSS 0.28%via GHSA
CVE-2026-57283Medium· 4.3
3mo ago

Jenkins Pipeline: Groovy Plugin has a CSRF vulnerability

Jenkins Pipeline: Groovy Plugin has a CSRF vulnerability

▾ Sunlitjenkins · io.jenkins.plugins:pipeline-groovy-libEPSS 0.24%via GHSA
CVE-2026-57287Medium· 4.3
3mo ago

Jenkins Job Configuration History Plugin doesn't redact encrypted values of secrets in job and agent configurations

Jenkins Job Configuration History Plugin doesn't redact encrypted values of secrets in job and agent configurations

▾ Sunlitjenkins-ci · org.jenkins-ci.plugins:jobConfigHistoryEPSS 0.19%via GHSA
CVE-2026-57299Medium· 4.3
3mo ago

Missing permission checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow attackers with Overall/Read permission to enumerate the names of configured Contrast metadata.

Missing permission checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow attackers with Overall/Read permission to enumerate the names of configured Contrast metadata.

▾ Sunlitjenkins · contrast_continuous_application_securityEPSS 0.25%via NVD
CVE-2026-57297Medium· 4.3
3mo ago

A missing permission check in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username, API key, a…

A missing permission check in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username, API key, a…

▾ Sunlitjenkins · contrast_continuous_application_securityEPSS 0.25%via NVD
GHSA-vjr9-f93j-mjr7High· 8.1
3mo ago

Duplicate Advisory: OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)

Duplicate Advisory: OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)

▾ Twilightopenremote · io.openremote:openremote-managervia GHSA
CVE-2026-41862High· 8.8
3mo ago

Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to re…

Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to re…

▾ Twilightbroadcom · spring_statemachineEPSS 0.76%via NVD
CVE-2026-45049High· 8.3
3mo ago

OpenAM Unauthenticated Session Hijacking via Information Exposure in CDCServlet

OpenAM Unauthenticated Session Hijacking via Information Exposure in CDCServlet

▾ Twilightopenidentityplatform · org.openidentityplatform.openam:openam-federationvia GHSA
CVE-2026-54518Medium· 6.5
3mo ago

jackson-databind: jackson-databind: Information disclosure and data manipulation via view-based access control bypass (CVE-2026-54518)

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass security view restrictions by sending specially crafted JSON (JavaScript Object Notation) data. The UnwrappedPropertyHandler component, which proce…

▾ SunlitRed Hat · Red Hat OpenShift AI (RHOAI)EPSS 0.35%via CSAF
CVE-2026-50193High· 7.5
3mo ago

jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing (CVE-2026-50193)

A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that rea…

▾ TwilightRed Hat · Red Hat JBoss EAP 7.4 ELS for RHEL 8EPSS 0.62%via CSAF
CVE-2026-54512High· 8.1PoC
3mo ago

jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512)

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious ty…

▾ MidnightRed Hat · Red Hat JBoss EAP 8.1 for RHEL 8EPSS 1.00%via CSAF
CVEs tagged “maven” — page 8 · VulnSea