Junglewise

Package ecosystem

Maven package vulnerabilities

Updated . Rebuilt every hour.

Junglewise Threat Intelligence has tracked 7,218 vulnerabilities in Maven packages: 2 in the last 7 days and 198 in the last 90 days, 217 of them critical and 53 exploited in the wild. The most recent, CVE-2026-59171, was published on 6 November 2026. 33 vulnerabilities in the last four weeks, down 64% on the four before (92). 1 critical against 12. 729 packages have a page of their own.

Last 7 days
2
Last 90 days
198
Critical, all time
217
Exploited in the wild
53

About Maven

Apache Maven is a build automation and project management tool for Java applications.

Homepage

Maven packages

Latest Maven package vulnerabilities

Most severe Maven package vulnerabilities

Exploited in the wild first, then by severity and CVSS score.

Vulnerabilities per week

33 vulnerabilities in the last four weeks, down 64% on the four before (92). 1 critical against 12. The last 13 weeks, by the week each vulnerability was published.

Vulnerabilities published per week, UTC
Week ofBarVulnsCritical
17 Aug 2026
223
24 Aug 2026
3713
31 Aug 2026
80
7 Sep 2026
61
14 Sep 2026
669
21 Sep 2026
122
28 Sep 2026
41
5 Oct 2026
100
12 Oct 2026
80
19 Oct 2026
60
26 Oct 2026
121
2 Nov 2026
70
9 Nov 2026
00

Embed a badge

Maven package vulnerabilities this week

A live badge for a README, a status page or an internal wiki: how many Maven package vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.

[![Maven package vulnerabilities](https://junglewise.ai/threats/vendors/maven/badge.svg)](https://junglewise.ai/threats/vendors/maven)
<a href="https://junglewise.ai/threats/vendors/maven"><img src="https://junglewise.ai/threats/vendors/maven/badge.svg" alt="Maven package vulnerabilities" /></a>

How this is built

Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.

The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.

Use this data

The same data is at https://junglewise.ai/threats/vendors/maven.json, and this page as text at https://junglewise.ai/threats/vendors/maven.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.

Cite as: Junglewise Threat Intelligence, "Maven package vulnerabilities", https://junglewise.ai/threats/vendors/maven, 13 November 2026.