CVE-2026-88889 | High | 7.8 | 2026-09-10 | Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifyi… |
CVE-2026-88888 | High | 7.0 | 2026-09-10 | Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization paramete… |
CVE-2026-88887 | High | 8.6 | 2026-09-10 | Renovate is a dependency update automation tool. When listing tags/digests for a container image, Renovate follows pagination links supplied by the remote regi… |
CVE-2026-88886 | High | 7.8 | 2026-09-10 | Renovate is a dependency update automation tool. In versions before 44.14.7 (and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-ente… |
CVE-2026-88885 | High | 7.0 | 2026-09-10 | Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depName parameters in import-path update comm… |
CVE-2026-88884 | Medium | 5.8 | 2026-09-10 | Renovate is a dependency update automation tool. In versions before 44.3.1 (and Mend Renovate CE/EE images before 15.4.0, mend-renovate-ce Helm chart before 15… |
CVE-2026-88883 | High | 7.7 | 2026-09-10 | Renovate is an automated dependency update tool. In versions before 44.14.4 (and Mend Renovate CE/EE images before 15.4.0 and the mend-renovate-enterprise-edit… |
CVE-2026-88882 | High | 8.6 | 2026-09-10 | Renovate is a dependency update automation tool. In versions before 44.11.2 (and Mend Renovate CE/EE images and charts before 15.4.0, and mend-renovate-enterpr… |
CVE-2026-88881 | High | 8.6 | 2026-09-10 | Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HTTP `Link` header when interacting with GitHub.com, GitHub E… |
CVE-2026-88880 | High | 8.6 | 2026-09-10 | Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing malicious servers to redirect credential-b… |
CVE-2026-76233 | Medium | 6.7 | 2026-08-19 | Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the depName parameter is appended to gleam d… |
CVE-2026-76232 | Medium | 6.7 | 2026-08-19 | Renovate versions from 31.51.0 before 40.33.0 contain a command injection vulnerability in the helmv3 manager where the repository parameter is appended to hel… |
CVE-2026-76231 | Medium | 6.7 | 2026-08-19 | Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appende… |
CVE-2026-76230 | Medium | 6.7 | 2026-08-19 | Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended… |
CVE-2026-76229 | Medium | 6.7 | 2026-08-19 | Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names ar… |
CVE-2026-76228 | Medium | 6.7 | 2026-08-19 | Renovate versions >=32.124.0 and before 42.68.5 (and Mend renovate-ce/renovate-ee before 13.3.0) contain a command injection vulnerability in Gradle Wrapper ar… |
CVE-2026-76227 | Medium | 5.5 | 2026-08-19 | Renovate versions from 42.68.1 before 42.96.3 and from 43.0.0 before 43.4.4, including the renovate/renovate Docker images, and Mend Renovate CE/EE images (ren… |
CVE-2026-76226 | Medium | 6.3 | 2026-08-19 | Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintena… |
CVE-2020-37267 | High | 7.5 | 2026-08-19 | Renovate versions >=19.180.0 and <23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git htt… |
CVE-2019-25766 | High | 7.5 | 2026-08-19 | Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The… |