{"items":[{"id":"CVE-2026-25063","published":"2026-01-29T21:47:16.881Z","updated":"2026-02-10T14:55:17.356Z","title":"gradle-completion has a Bash command injection issue","severity":"HIGH","score":8.3,"vendor":"gradle","product":"gradle-completion","kev":false,"epss":0.0079,"kevAdded":null},{"id":"CVE-2026-22865","published":"2026-01-16T22:46:19.741Z","updated":"2026-01-20T14:47:41.205Z","title":"Gradle's failure to disable repositories failing to answer can expose builds to malicious artifacts","severity":"HIGH","score":8.6,"vendor":"gradle","product":"gradle","kev":false,"epss":0.00158,"kevAdded":null},{"id":"CVE-2026-22816","published":"2026-01-16T22:45:48.937Z","updated":"2026-01-20T14:49:32.077Z","title":"Gradle fails to disable repositories which can expose builds to malicious artifacts","severity":"HIGH","score":8.6,"vendor":"gradle","product":"gradle","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2025-27148","published":"2025-02-25T20:13:51.578Z","updated":"2025-02-25T21:20:46.507Z","title":"Gradle vulnerable to local privilege escalation through system temporary directory","severity":"HIGH","score":8.8,"vendor":"gradle","product":"gradle","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2025-24858","published":"2025-01-26T00:00:00.000Z","updated":"2025-02-12T20:01:14.275Z","title":"Develocity (formerly Gradle Enterprise) before 2024.3.1 allows an attacker who has network access to a Develocity server to obtain the hashed password of the…","severity":"HIGH","score":8.3,"vendor":"Gradle","product":"Enterprise","kev":false,"epss":0.00492,"kevAdded":null},{"id":"CVE-2024-46881","published":"2025-01-26T00:00:00.000Z","updated":"2025-01-27T16:56:26.914Z","title":"Develocity (formerly Gradle Enterprise) before 2024.1.8 has Incorrect Access Control. Project-level access control configuration was introduced in Enterprise…","severity":"HIGH","score":7.1,"vendor":"Gradle","product":"Enterprise","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2023-42445","published":"2023-10-06T13:52:02.982Z","updated":"2025-06-16T17:08:05.678Z","title":"Possible local file exfiltration by XML External entity injection","severity":"MEDIUM","score":6.8,"vendor":"gradle","product":"gradle","kev":false,"epss":0.00781,"kevAdded":null},{"id":"CVE-2023-44387","published":"2023-10-05T17:51:15.407Z","updated":"2026-10-08T21:24:17.955Z","title":"Gradle has incorrect permission assignment for symlinked files used in copy or archiving operations","severity":"LOW","score":3.2,"vendor":"gradle","product":"gradle","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2023-35946","published":"2023-06-30T20:21:17.219Z","updated":"2026-10-08T21:24:18.358Z","title":"Dependency cache path traversal in Gradle","severity":"MEDIUM","score":6.9,"vendor":"gradle","product":"gradle","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2023-35947","published":"2023-06-30T20:18:06.263Z","updated":"2026-11-02T22:36:08.104Z","title":"Path traversal vulnerabilities in handling of Tar archives in Gradle","severity":"MEDIUM","score":6.9,"vendor":"gradle","product":"gradle","kev":false,"epss":0.00528,"kevAdded":null},{"id":"CVE-2023-30853","published":"2023-04-28T15:10:18.046Z","updated":"2025-01-30T17:06:40.274Z","title":"Gradle Build Action data written to GitHub Actions Cache may expose secrets","severity":"HIGH","score":7.6,"vendor":"gradle","product":"gradle-build-action","kev":false,"epss":0.00285,"kevAdded":null},{"id":"CVE-2023-26053","published":"2023-03-02T03:11:31.488Z","updated":"2025-03-05T21:15:36.343Z","title":"Gradle usage of long IDs for PGP keys opens potential for collision attacks","severity":"MEDIUM","score":6.6,"vendor":"gradle","product":"gradle","kev":false,"epss":0.00994,"kevAdded":null},{"id":"CVE-2022-31156","published":"2022-07-14T20:05:11.000Z","updated":"2025-04-23T18:02:03.963Z","title":"Gradle's dependency verification can ignore checksum verification when signature verification cannot be performed","severity":"MEDIUM","score":6.6,"vendor":"gradle","product":"gradle","kev":false,"epss":0.00557,"kevAdded":null},{"id":"CVE-2022-23630","published":"2022-02-10T20:10:09.000Z","updated":"2025-04-23T19:05:40.404Z","title":"Dependency verification bypass in Gradle","severity":"HIGH","score":7.5,"vendor":"gradle","product":"gradle","kev":false,"epss":0.0132,"kevAdded":null},{"id":"CVE-2021-32751","published":"2021-07-20T22:55:12.000Z","updated":"2026-10-08T21:24:18.605Z","title":"Arbitrary code execution via specially crafted environment variables","severity":"HIGH","score":7.5,"vendor":"gradle","product":"gradle","kev":false,"epss":0.02709,"kevAdded":null},{"id":"CVE-2021-29427","published":"2021-04-13T17:55:24.000Z","updated":"2024-08-03T22:02:51.882Z","title":"Repository content filters do not work in Settings pluginManagement","severity":"HIGH","score":8,"vendor":"gradle","product":"gradle","kev":false,"epss":0.01307,"kevAdded":null},{"id":"CVE-2021-29428","published":"2021-04-13T17:55:18.000Z","updated":"2026-10-08T21:24:19.230Z","title":"Local privilege escalation through system temporary directory","severity":"HIGH","score":8.8,"vendor":"gradle","product":"gradle","kev":false,"epss":0.00542,"kevAdded":null},{"id":"CVE-2021-29429","published":"2021-04-12T21:30:12.000Z","updated":"2026-10-08T21:24:18.850Z","title":"Information disclosure through temporary directory permissions","severity":"MEDIUM","score":4,"vendor":"gradle","product":"gradle","kev":false,"epss":0.00484,"kevAdded":null}]}