CVE WATCH / VULNERABILITY DETAIL
CVE-2026-75598
MEDIUMCVSS 6.3NVD feed
Published 6 November 2026 · tracked since 7 November 2026
Description
The Gradle Shadow plugin creates fat or uber JARs and supports file transformation and package relocation. Prior to version 9.6.0, Shadow does not independently validate ZIP entry names before writing them to its output archive. A malicious dependency can cause traversal entry names to be preserved
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-123998 HIGH 8.3
- CVE-2026-119924 HIGH 8.1
- CVE-2026-119923 CRITICAL 9.8
- CVE-2026-108262 MEDIUM 6.5
- CVE-2026-100080
- CVE-2026-89017 HIGH 7.5
- CVE-2026-123824 MEDIUM 6.3
- CVE-2026-102650 HIGH 7.5
- CVE-2026-85743 HIGH 8.2
- CVE-2026-62855 MEDIUM 4.4