Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure through the processing of build scan links detected in the build log. An attacker can obtain the Develocity access key configured in the global configuration by manipulating the build log to include a malicious URL,...

CVE-2026-92132

Jenkins Gradle Plugin 2.19.1252.v15196b5a6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global configuration, allowing attackers able to control the build log to capture the Develocity access key...

EUVD-2026-80756

Jenkins Gradle Plugin 2.19.1252.v15196b5a6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global configuration, allowing attackers able to control the build log to capture the Develocity access key...

CVE-2026-92132

The Jenkins Gradle Plugin (version 2.19.1252.v15196b_5a_6e10 and earlier) is vulnerable to a Server-Side Request Forgery (SSRF) where it requests build scan data from links detected in build logs. This occurs even if a Develocity server URL is set in the global configuration. An attacker capable ...

CVE-2026-92132

Jenkins Gradle Plugin 2.19.1252.v15196b5a6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global configuration, allowing attackers able to control the build log to capture the Develocity access key...

CVE-2026-92132

Jenkins Gradle Plugin 2.19.1252.v15196b5a6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global configuration, allowing attackers able to control the build log to capture the Develocity access key...

SSRF vulnerability in gradle allows capturing the Develocity access key

gradle provides global options for administrators to detect build scan links in build logs, and to show an enriched build scan summary for those build scans on the build page. In gradle 2.19.1252.v15196b5a6e10 and earlier, the enriched build scan summary requests data from the build scan link...

PT-2026-93775

Name of the Vulnerable Software and Affected Versions Jenkins Gradle Plugin versions prior to 2.19.1252.v15196b 5a 6e10 Description The plugin requests build scan data from links detected in the build log, regardless of whether a Develocity server URL is set in the global configuration. This allo...

CVE-2026-92132: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Jenkins Gradle Plugin 2.19.1252.v15196b5a6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global configuration, allowing attackers able to control the build log to capture the Develocity access key...

Gradle Develocity Build Cache Node Login Panel - Detect

Gradle Develocity Build Cache Node login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Gradle Develocity Build Cache Node login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

EUVD-2024-42218

Malicious code in bioql PyPI...

EUVD-2025-3961

Malicious code in bioql PyPI...

CVE-2025-24858

Develocity formerly Gradle Enterprise before 2024.3.1 allows an attacker who has network access to a Develocity server to obtain the hashed password of the system user. The hash algorithm used by Develocity was chosen according to best practices for password storage and provides some protection...

CVE-2024-46881

Develocity formerly Gradle Enterprise before 2024.1.8 has Incorrect Access Control. Project-level access control configuration was introduced in Enterprise Config schema version 8. Migration functionality from schema version 8 to versions 9 and 10 in affected vulnerable versions does not include...

CVE-2024-46881

Develocity formerly Gradle Enterprise before 2024.1.8 has Incorrect Access Control. Project-level access control configuration was introduced in Enterprise Config schema version 8. Migration functionality from schema version 8 to versions 9 and 10 in affected vulnerable versions does not include...

CVE-2025-24858

Develocity formerly Gradle Enterprise before 2024.3.1 allows an attacker who has network access to a Develocity server to obtain the hashed password of the system user. The hash algorithm used by Develocity was chosen according to best practices for password storage and provides some protection...

PT-2025-5588 · Unknown · Develocity

Name of the Vulnerable Software and Affected Versions: Develocity versions prior to 2024.3.1 Description: The issue allows an attacker with network access to a Develocity server to obtain the hashed password of the system user. The hash algorithm used provides some protection against brute-force...

CVE-2024-46881

Develocity formerly Gradle Enterprise before 2024.1.8 has Incorrect Access Control. Project-level access control configuration was introduced in Enterprise Config schema version 8. Migration functionality from schema version 8 to versions 9 and 10 in affected vulnerable versions does not include...

CVE-2024-46881

Develocity formerly Gradle Enterprise before 2024.1.8 has Incorrect Access Control. Project-level access control configuration was introduced in Enterprise Config schema version 8. Migration functionality from schema version 8 to versions 9 and 10 in affected vulnerable versions does not include...

CVE-2025-24858

Develocity formerly Gradle Enterprise before 2024.3.1 allows an attacker who has network access to a Develocity server to obtain the hashed password of the system user. The hash algorithm used by Develocity was chosen according to best practices for password storage and provides some protection...