Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure through the processing of build scan links detected in the build log. An attacker can obtain the Develocity access key configured in the global configuration by manipulating the build log to include a malicious URL,...

CVE-2026-92132

Jenkins Gradle Plugin 2.19.1252.v15196b5a6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global configuration, allowing attackers able to control the build log to capture the Develocity access key...

EUVD-2026-80756

Jenkins Gradle Plugin 2.19.1252.v15196b5a6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global configuration, allowing attackers able to control the build log to capture the Develocity access key...

CVE-2026-92132

The Jenkins Gradle Plugin (version 2.19.1252.v15196b_5a_6e10 and earlier) is vulnerable to a Server-Side Request Forgery (SSRF) where it requests build scan data from links detected in build logs. This occurs even if a Develocity server URL is set in the global configuration. An attacker capable ...

CVE-2026-92132

Jenkins Gradle Plugin 2.19.1252.v15196b5a6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global configuration, allowing attackers able to control the build log to capture the Develocity access key...

CVE-2026-92132

Jenkins Gradle Plugin 2.19.1252.v15196b5a6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global configuration, allowing attackers able to control the build log to capture the Develocity access key...

PT-2026-93775

Name of the Vulnerable Software and Affected Versions Jenkins Gradle Plugin versions prior to 2.19.1252.v15196b 5a 6e10 Description The plugin requests build scan data from links detected in the build log, regardless of whether a Develocity server URL is set in the global configuration. This allo...

SSRF vulnerability in gradle allows capturing the Develocity access key

gradle provides global options for administrators to detect build scan links in build logs, and to show an enriched build scan summary for those build scans on the build page. In gradle 2.19.1252.v15196b5a6e10 and earlier, the enriched build scan summary requests data from the build scan link...

CVE-2026-92132: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Jenkins Gradle Plugin 2.19.1252.v15196b5a6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global configuration, allowing attackers able to control the build log to capture the Develocity access key...

EUVD-2025-3961

Malicious code in bioql PyPI...

EUVD-2024-42218

Malicious code in bioql PyPI...

CVE-2025-24858

Develocity formerly Gradle Enterprise before 2024.3.1 allows an attacker who has network access to a Develocity server to obtain the hashed password of the system user. The hash algorithm used by Develocity was chosen according to best practices for password storage and provides some protection...

CVE-2024-46881

Develocity formerly Gradle Enterprise before 2024.1.8 has Incorrect Access Control. Project-level access control configuration was introduced in Enterprise Config schema version 8. Migration functionality from schema version 8 to versions 9 and 10 in affected vulnerable versions does not include...

CVE-2024-46881

Develocity formerly Gradle Enterprise before 2024.1.8 has Incorrect Access Control. Project-level access control configuration was introduced in Enterprise Config schema version 8. Migration functionality from schema version 8 to versions 9 and 10 in affected vulnerable versions does not include...

CVE-2025-24858

Develocity formerly Gradle Enterprise before 2024.3.1 allows an attacker who has network access to a Develocity server to obtain the hashed password of the system user. The hash algorithm used by Develocity was chosen according to best practices for password storage and provides some protection...

CVE-2024-46881

The CVE-2024-46881 issue in Develocity (Gradle Enterprise) stems from an incorrect access-control migration. Enterprise Config schema v8 introduced project-level access control; when upgrading to schemas 9/10, the projects section may be omitted, causing all project settings to reset to defaults ...

Gradle 安全漏洞

Gradle is a set of JVM-based project building tools from Gradle, Inc. that supports maven, Ivy repositories, and more. A security vulnerability exists in Gradle Develocity versions prior to 2024.1.8, which stems from an incorrectly migrated project access control configuration that results in...

CVE-2025-24858: Insertion of Sensitive Information Into Sent Data

Develocity formerly Gradle Enterprise before 2024.3.1 allows an attacker who has network access to a Develocity server to obtain the hashed password of the system user. The hash algorithm used by Develocity was chosen according to best practices for password storage and provides some protection...

Gradle 安全漏洞

Gradle is a set of JVM-based project building tools from Gradle, Inc. that supports maven, Ivy repositories, and more. A security vulnerability exists in Gradle Develocity versions prior to 2024.3.1, which stems from a vulnerability that allows an attacker with network access privileges to obtain...

CVE-2024-46881

Develocity formerly Gradle Enterprise before 2024.1.8 has Incorrect Access Control. Project-level access control configuration was introduced in Enterprise Config schema version 8. Migration functionality from schema version 8 to versions 9 and 10 in affected vulnerable versions does not include...