420 matches found
CVE-2026-7860
CVE-2026-7860 describes an information-disclosure risk in Vaadin build tools: Vaadin Maven/Gradle plugins can print the full set of environment variables to build logs when a frontend build fails (non-zero exit). This can expose credentials/secrets in CI logs and artifacts. Affected ranges and fi...
PT-2026-41882
Name of the Vulnerable Software and Affected Versions Vaadin Maven plugin versions 23.0.0 through 23.6.9 Vaadin Maven plugin versions 24.0.0 through 24.9.16 Vaadin Maven plugin versions 24.10.0 through 24.10.3 Vaadin Maven plugin versions 25.0.0 through 25.0.10 Vaadin Maven plugin versions 25.1.0...
PT-2026-46866
A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaadin Gradle plugin that exposes the full set of environment variables in build logs whenever the frontend build process exits with a non-zero status. Because the build environment may contain credentials...
CVE-2026-7860: Generation of Error Message Containing Sensitive Information
A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaadin Gradle plugin that exposes the full set of environment variables in build logs whenever the frontend build process exits with a non-zero status. Because the build environment may contain credentials...
org.akhikhl.gretty:gretty-runner-tomcat8 (1.0.0), org.apache.tomcat.embed:tomcat-embed-jasper (8.0.8) +5 more potentially affected by CVE-2026-43514 via org.apache.tomcat.embed:tomcat-embed-core (8.0.8)
org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.akhikhl.gretty:gretty-runner-tomcat8 1.0.0 -...
org.akhikhl.gretty:gretty-runner-tomcat8 (1.0.0), org.apache.tomcat.embed:tomcat-embed-jasper (8.0.8) +5 more potentially affected by CVE-2026-41284 via org.apache.tomcat.embed:tomcat-embed-core (8.0.8)
org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.akhikhl.gretty:gretty-runner-tomcat8 1.0.0 -...
org.akhikhl.gretty:gretty-runner-tomcat8 (1.0.0), org.apache.tomcat.embed:tomcat-embed-jasper (8.0.8) +5 more potentially affected by CVE-2026-43515 via org.apache.tomcat.embed:tomcat-embed-core (8.0.8)
org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.akhikhl.gretty:gretty-runner-tomcat8 1.0.0 -...
ch.cern:cerndb-sw-zkpolicy (1.0.1-21), cloud.metaapi.sdk:metaapi-common-java (>=1.0.0, <=1.0.1) +260 more potentially affected by CVE-2026-34478 via org.apache.logging.log4j:log4j-core (>=3.0.0-beta1, <=3.0.0-beta3)
org.apache.logging.log4j:log4j-core MAVEN version =3.0.0-beta1, =1.0.0, =0.0.2, =00.00.03, =1.0.6, =1.0.7, =1.0.0, =2.0.21, =1.0, =1.0.2 - com.frostphyr:customappender 1.1.0 and more Source cves: CVE-2026-34478 Source advisory: SNYK:JAVA-ORGAPACHELOGGINGLOG4J-15967739...
aero.albers.osmbse:mdzip-process-sources-maven-plugin (0.0.1), aero.albers.osmbse:mdzip-validate-maven-plugin (0.0.1) +17864 more potentially affected by CVE-2025-67030 via org.codehaus.plexus:plexus-utils (>=3.0, <=3.6.0)
org.codehaus.plexus:plexus-utils MAVEN version =3.0, =3.8.0, =1.9.0, =1.9.0, =1.9.0, =0.1, =0.1.0, =0.0.1, =0.0.6, =0.1.10, =0.1.3, =0.0.1, =0.0.1, =0.2.0, =0.2.11 and more Source cves: CVE-2025-67030 Source advisory: OSV:GHSA-6FMV-XXPF-W3CW...
com.vaadin:com.vaadin.gradle.plugin (>=22.0.7, <=22.0.8), com.vaadin:flow (9.0.8) +100 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (9.0.8)
com.vaadin:flow-server MAVEN version 9.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.vaadin:com.vaadin.gradle.plugin =22.0.7, =22.0.8 - com.vaadin:flow 9.0.8 - com.vaadin:flow-client 9.0.8 -...
com.vaadin:com.vaadin.gradle.plugin (>=0.5.0, <=0.6.0), com.vaadin:flow (2.1.4) +14 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (2.1.4)
com.vaadin:flow-server MAVEN version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.vaadin:com.vaadin.gradle.plugin =0.5.0, =0.5.0, =0.6.0 - com.vaadin:vaadin-lumo-theme 2.1.4 and more Source cve...
Malicious code in gradle-plugin (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2250213d706eee1473dafe9b75172ac8e22adbf885bf28e4b2b85270de1ffbc8 The package gradle-plugin was found to contain malicious code. Source: ghsa-malware 0d6c8dc0207f1992c957598d80609ff61b750f041d94dde7984a3e0a6133d54e...
Malicious Package
Overview gradle-plugin is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
MAL-2026-221 Malicious code in gradle-plugin (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2250213d706eee1473dafe9b75172ac8e22adbf885bf28e4b2b85270de1ffbc8 The package gradle-plugin was found to contain malicious code. Source: ghsa-malware 0d6c8dc0207f1992c957598d80609ff61b750f041d94dde7984a3e0a6133d54e...
EUVD-2026-1980
Malicious code in gradle-plugin npm...
CVE-2020-7599
All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File. When a plugin author publishes a Gradle plugin while running Gradle with the --info log level flag, the Gradle Logger logs an AWS pre-signed URL. If this build log is public...
com.cyclonedx:cyclonedx-gradle-plugin (>=1.1.2, <=1.5.0), com.free-now.sauron.plugins:dependency-checker (>=0.0.57, <=0.0.74) +102 more potentially affected by CVE-2025-64518 via org.cyclonedx:cyclonedx-core-java (>=2.1.1, <=11.0.0)
org.cyclonedx:cyclonedx-core-java MAVEN version =2.1.1, =1.1.2, =0.0.57, =1.0.0, =0.4.0, =1.0.0, =1.0.0, =0.9.0, =0.120.0, =0.9.0, =0.105.0, =0.157.0, =0.157.0, =0.137.0, =0.115.0, =0.9.0, =0.125.0 and more Source cves: CVE-2025-64518 Source advisor...
EUVD-2021-0678
Malware in sbrugna...