GR
Vendor
Gradle
56
CVEs
0
On KEV
0
New 30D
Products
GR9.8
gradle
gradle
23 CVEs0 on KEV0 new
EN9.8
Enterprise
Gradle
21 CVEs0 on KEV0 new
BC9.8
Build Cache Node
Gradle
2 CVEs0 on KEV0 new
EC7.5
Enterprise Cache Node
Gradle
2 CVEs0 on KEV0 new
MA7.8
Maven
Gradle
2 CVEs0 on KEV0 new
BA6.5
Build Action
Gradle
1 CVEs0 on KEV0 new
ET6.5
Enterprise Test Distribution Agent
Gradle
1 CVEs0 on KEV0 new
GR7.8
gradle-completion
gradle
1 CVEs0 on KEV0 new
GE7.5
Gradle Enterprise
Gradle
1 CVEs0 on KEV0 new
PP6.5
Plugin Publishing
Gradle
1 CVEs0 on KEV0 new
TD6.5
Test Distribution
Gradle
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-25063 | GR gradle-completion gradle | 7.8 | Jan 29 | gradle-completion has a Bash command injection issue |
| CVE-2026-22865 | GR gradle gradle | 7.4 | Jan 16 | Gradle's failure to disable repositories failing to answer can expose builds to malicious artifacts |
| CVE-2026-22816 | GR gradle gradle | 7.4 | Jan 16 | Gradle fails to disable repositories which can expose builds to malicious artifacts |
| CVE-2023-49238 | EN Enterprise Gradle | 9.8 | Jan 9 | In Gradle Enterprise before 2023.1, a remote attacker may be able to gain access to a new installation (in certain installation scenarios) because of a non-unique initial system… |
| CVE-2023-42445 | GR Gradle Gradle | 5.3 | Oct 6 | Gradle is a build tool with a focus on build automation and support for multi-language development |
| CVE-2023-44387 | GR gradle gradle | 6.5 | Oct 5 | Gradle has incorrect permission assignment for symlinked files used in copy or archiving operations |
| CVE-2023-35947 | GR Gradle Gradle | 8.1 | Jun 30 | Gradle is a build tool with a focus on build automation and support for multi-language development |
| CVE-2023-35946 | GR gradle gradle | 5.5 | Jun 30 | Dependency cache path traversal in Gradle |
| CVE-2023-30853 | BA Build Action Gradle | 6.5 | Apr 28 | Gradle Build Action allows users to execute a Gradle Build in their GitHub Actions workflow |
| CVE-2023-26053 | GR Gradle Gradle | 9.8 | Mar 2 | Gradle is a build tool with a focus on build automation and support for multi-language development |
| CVE-2022-41575 | EN Enterprise Gradle | 7.5 | Oct 21 | A credential-exposure vulnerability in the support-bundle mechanism in Gradle Enterprise 2022.3 through 2022.3.3 allows remote attackers to access a subset of application data… |
| CVE-2022-41574 | EN Enterprise Gradle | 7.5 | Oct 7 | An access-control vulnerability in Gradle Enterprise 2022.4 through 2022.3.1 allows remote attackers to prevent backups from occurring, and send emails with arbitrary text content… |
| CVE-2022-31156 | GR Gradle Gradle | 4.4 | Jul 14 | Gradle is a build tool |
| CVE-2022-30587 | GE Gradle Enterprise Gradle | 7.5 | Jun 6 | Gradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to information disclosure |
| CVE-2022-30586 | GR Gradle Gradle | 7.2 | Jun 6 | Gradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to code execution |
| CVE-2022-27919 | EN Enterprise Gradle | 9.8 | Mar 25 | Gradle Enterprise before 2022.1 allows remote code execution if the installation process did not specify an initial configuration file |
| CVE-2022-25364 | EN Enterprise Gradle | 8.1 | Mar 17 | In Gradle Enterprise before 2021.4.2, the default built-in build cache configuration allowed anonymous write access |
| CVE-2022-27225 | EN Enterprise Gradle | 6.5 | Mar 16 | Gradle Enterprise before 2021.4.3 relies on cleartext data transmission in some situations |
| CVE-2022-23630 | GR Gradle Gradle | 7.5 | Feb 10 | Gradle is a build tool with a focus on build automation and support for multi-language development |
| CVE-2021-41619 | EN Enterprise Gradle | 7.2 | Oct 27 | An issue was discovered in Gradle Enterprise before 2021.1.2 |
| CVE-2021-41590 | EN Enterprise Gradle | 5.3 | Oct 27 | In Gradle Enterprise through 2021.3, probing of the server-side network environment can occur via an SMTP configuration test |
| CVE-2021-41589 | BC Build Cache Node Gradle | 9.8 | Oct 27 | In Gradle Enterprise before 2021.3 (and Enterprise Build Cache Node before 10.0), there is potential cache poisoning and remote code execution when running the build cache node… |
| CVE-2021-41588 | GR Gradle Gradle | 8.1 | Sep 24 | In Gradle Enterprise before 2021.1.3, a crafted request can trigger deserialization of arbitrary unsafe Java objects |
| CVE-2021-41587 | GR Gradle Gradle | 7.5 | Sep 24 | In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially discover credentials for other resources |
| CVE-2021-41586 | GR Gradle Gradle | 7.5 | Sep 24 | In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially reset the system user password |
| CVE-2021-41584 | GR Gradle Gradle | 7.5 | Sep 24 | Gradle Enterprise before 2021.1.3 can allow unauthorized viewing of a response (information disclosure of possibly sensitive build/configuration details) via a crafted HTTP… |
| CVE-2021-32751 | GR gradle gradle | 7.5 | Jul 20 | Arbitrary code execution via specially crafted environment variables |
| CVE-2021-29427 | GR Gradle Gradle | 7.2 | Apr 13 | In Gradle from version 5.1 and before version 7.0 there is a vulnerability which can lead to information disclosure and/or dependency poisoning |
| CVE-2021-29428 | GR gradle gradle | 7.8 | Apr 13 | Local privilege escalation through system temporary directory |
| CVE-2021-29429 | GR gradle gradle | 5.5 | Apr 12 | Information disclosure through temporary directory permissions |
| CVE-2021-26719 | MA Maven Gradle | 6.5 | Feb 9 | A directory traversal issue was discovered in Gradle gradle-enterprise-test-distribution-agent before 1.3.2, test-distribution-gradle-plugin before 1.3.2, and… |
| CVE-2020-11979 | GR Gradle Gradle | 7.5 | Oct 1 | As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them |
| CVE-2020-15773 | EN Enterprise Gradle | 6.5 | Sep 18 | An issue was discovered in Gradle Enterprise before 2020.2.4 |
| CVE-2020-15776 | EN Enterprise Gradle | 8.8 | Sep 18 | An issue was discovered in Gradle Enterprise 2018.2 - 2020.2.4 |
| CVE-2020-15775 | EN Enterprise Gradle | 7.5 | Sep 18 | An issue was discovered in Gradle Enterprise 2017.1 - 2020.2.4 |
| CVE-2020-15774 | EN Enterprise Gradle | 6.8 | Sep 18 | An issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4 |
| CVE-2020-15772 | EN Enterprise Gradle | 4.9 | Sep 18 | An issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4 |
| CVE-2020-15771 | EC Enterprise Cache Node Gradle | 7.5 | Sep 18 | An issue was discovered in Gradle Enterprise 2018.2 and Gradle Enterprise Build Cache Node 4.1 |
| CVE-2020-15770 | EN Enterprise Gradle | 5.5 | Sep 18 | An issue was discovered in Gradle Enterprise 2018.5 |
| CVE-2020-15769 | EN Enterprise Gradle | 6.1 | Sep 18 | An issue was discovered in Gradle Enterprise 2020.2 - 2020.2.4 |
| CVE-2020-15768 | EN Enterprise Gradle | 7.5 | Sep 18 | An issue was discovered in Gradle Enterprise 2017.3 - 2020.2.4 and Gradle Enterprise Build Cache Node 1.0 - 9.2 |
| CVE-2020-15767 | EN Enterprise Gradle | 5.3 | Sep 18 | An issue was discovered in Gradle Enterprise before 2020.2.5 |
| CVE-2020-15777 | MA Maven Gradle | 7.8 | Aug 25 | An issue was discovered in the Maven Extension plugin before 1.6 for Gradle Enterprise |
| CVE-2020-7599 | PP Plugin Publishing Gradle | 6.5 | Mar 30 | All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File |
| CVE-2019-16370 | GR Gradle Gradle | 5.9 | Sep 16 | The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1… |
| CVE-2019-15052 | GR Gradle Gradle | 9.8 | Aug 14 | The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host |
| CVE-2019-11403 | EN Enterprise Gradle | 9.8 | Apr 22 | In Gradle Enterprise before 2018.5.2, Build Cache Nodes would reflect the configured password back when viewing the HTML page source of the settings page |
| CVE-2019-11402 | EN Enterprise Gradle | 9.8 | Apr 22 | In Gradle Enterprise before 2018.5.3, Build Cache Nodes did not store the credentials at rest in an encrypted format |
| CVE-2019-11065 | GR Gradle Gradle | 5.9 | Apr 10 | Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins are used |
| CVE-2016-6199 | GR Gradle Gradle | 9.8 | Feb 7 | ObjectSocketWrapper.java in Gradle 2.12 allows remote attackers to execute arbitrary code via a crafted serialized object |