RE
Product
renovate
25
CVEs
0
On KEV
8.6
Max CVSS
4
New 30D
Severity mix
Critical 0High 14Medium 11Low 0
Watch
Add renovate to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-88887 | 8.6 | Sep 10 | Renovate before 44.11.2 Credential Exfiltration via Link Header Affected: before 44.11.2 |
| CVE-2026-88882 | 8.6 | Sep 10 | Renovate before 44.11.2 Credential Exfiltration via Link Header Affected: before 44.11.2 |
| CVE-2026-88881 | 8.6 | Sep 10 | Renovate before 44.11.3 Credential Exfiltration via Link Header Affected: before 44.11.3 |
| CVE-2026-88880 | 8.6 | Sep 10 | Renovate before 44.11.3 Credential Exfiltration via Link Header Affected: before 44.11.3 |
| CVE-2026-110868 | 8.5 | Oct 14 | Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources Affected: before 44.79.0 |
| CVE-2026-110867 | 8.5 | Oct 14 | Renovate before 44.60.1 allowedEnv Allowlist Bypass via Shared Preset Affected: before 44.60.1 |
| CVE-2026-88889 | 7.8 | Sep 10 | Renovate before 44.14.7 Command Injection via distributionType Affected: before 44.14.7 |
| CVE-2026-88886 | 7.8 | Sep 10 | Renovate before 44.14.7 Command Injection via gradle-wrapper Affected: before 44.14.7 |
| CVE-2026-88883 | 7.7 | Sep 10 | Renovate before 44.14.4 TLS Private Key Log Sanitisation Affected: before 44.14.4 |
| CVE-2020-37267 | 7.5 | Aug 19 | Renovate 19.180.0 before 23.25.1 Token Leakage via Logs Affected: 19.180.0 before 23.25.1 |
| CVE-2019-25766 | 7.5 | Aug 19 | Renovate before 19.38.7 Credential Exposure via Go Modules Affected: 13.87.0 before 19.38.7 |
| CVE-2026-110865 | 7.1 | Oct 14 | Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets Affected: before 44.60.1 |
| CVE-2026-88888 | 7.0 | Sep 10 | Renovate before 44.14.7 Command Injection via Mix organization Affected: before 44.14.7 |
| CVE-2026-88885 | 7.0 | Sep 10 | Renovate before 44.14.7 Command Injection via depName Affected: before 44.14.7 |
| CVE-2026-76233 | 6.7 | Aug 19 | Renovate 39.53.0 before 40.33.0 Command Injection via gleam manager Affected: 39.53.0 before 40.33.0 |
| CVE-2026-76232 | 6.7 | Aug 19 | Renovate 31.51.0 before 40.33.0 Command Injection via helmv3 Affected: 31.51.0 before 40.33.0 |
| CVE-2026-76231 | 6.7 | Aug 19 | Renovate 32.135.0 before 40.33.0 Command Injection via hermit Affected: 32.135.0 before 40.33.0 |
| CVE-2026-76230 | 6.7 | Aug 19 | Renovate 35.63.0 before 40.33.0 Command Injection via npm Affected: 35.63.0 before 40.33.0 |
| CVE-2026-76229 | 6.7 | Aug 19 | Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize Affected: 39.218.0 before 40.33.0 |
| CVE-2026-76228 | 6.7 | Aug 19 | Renovate before 42.68.5 Remote Code Execution via Gradle Wrapper Affected: 32.124.0 before 42.68.5 |
| CVE-2024-58376 | 6.7 | Aug 19 | Renovate 37.158.0 before 37.199.0 Command Injection via helmv3 Affected: 37.158.0 before 37.199.0 |
| CVE-2026-76226 | 6.3 | Aug 19 | Renovate 43.65.0 before 43.102.11 Remote Code Execution via lockFileMaintenance Affected: 43.65.0 before 43.102.11 |
| CVE-2026-88884 | 5.8 | Sep 10 | Renovate before 44.3.1 Authentication Bypass via Digest Updates Affected: before 44.3.1 |
| CVE-2026-76227 | 5.5 | Aug 19 | Renovate 42.68.1 before 42.96.3 and 43.0.0 before 43.4.4 Environment Variable Exposure Affected: 42.68.1 before 42.96.3; 43.0.0 before 43.4.4 |
| CVE-2026-110866 | 4.7 | Oct 14 | Renovate before 44.61.3 minimumReleaseAge Bypass via PR Rebase Request Affected: before 44.61.3 |
Showing 25