Gradle

Products

Exploited and recent CVEs

• CVE-2026-25063 High 8.3 gradle-completion has a Bash command injection issue 0.8%
• CVE-2026-22865 High 8.6 Gradle's failure to disable repositories failing to answer can expose builds to malicious artifacts 0.2%
• CVE-2026-22816 High 8.6 Gradle fails to disable repositories which can expose builds to malicious artifacts 0.2%
• CVE-2025-27148 High 8.8 Gradle vulnerable to local privilege escalation through system temporary directory 0.2%
• CVE-2025-24858 High 8.3 Develocity (formerly Gradle Enterprise) before 2024.3.1 allows an attacker who has network access to a Develocity server to obtain the hashed password of the system user. The hash algorithm used by De 0.5%
• CVE-2024-46881 High 7.1 Develocity (formerly Gradle Enterprise) before 2024.1.8 has Incorrect Access Control. Project-level access control configuration was introduced in Enterprise Config schema version 8. Migration functio 0.3%
• CVE-2023-42445 Medium 6.8 Possible local file exfiltration by XML External entity injection 0.8%
• CVE-2023-44387 Low 3.2 Gradle has incorrect permission assignment for symlinked files used in copy or archiving operations 0.2%
• CVE-2023-35946 Medium 6.9 Dependency cache path traversal in Gradle 0.3%
• CVE-2023-35947 Medium 6.9 Path traversal vulnerabilities in handling of Tar archives in Gradle 0.5%
• CVE-2023-30853 High 7.6 Gradle Build Action data written to GitHub Actions Cache may expose secrets 0.3%
• CVE-2023-26053 Medium 6.6 Gradle usage of long IDs for PGP keys opens potential for collision attacks 1.0%
• CVE-2022-31156 Medium 6.6 Gradle's dependency verification can ignore checksum verification when signature verification cannot be performed 0.6%
• CVE-2022-23630 High 7.5 Dependency verification bypass in Gradle 1.3%
• CVE-2021-32751 High 7.5 Arbitrary code execution via specially crafted environment variables 2.7%
• CVE-2021-29427 High 8.0 Repository content filters do not work in Settings pluginManagement 1.3%
• CVE-2021-29428 High 8.8 Local privilege escalation through system temporary directory 0.5%
• CVE-2021-29429 Medium 4.0 Information disclosure through temporary directory permissions 0.5%